joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ad30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x14001ada1
movups xmm0, xmmword [0x140068070]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x6b
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.140015580
test eax, eax
setne al
jmp 0x14001ae05
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.140019b30
test al, al
je 0x14001ae03
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_107
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001adfd
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001ae05
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001ae30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov rbx, rdx
mov r8d, 1
mov rdi, rcx
call fcn.140015180
mov r9d, 1
mov rdx, rbx
mov rcx, rdi
test eax, eax
je 0x14001aea3
movups xmm0, xmmword [0x140068070]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], 7
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.1400152c0
test eax, eax
setne al
jmp 0x14001aefa
lea r8, [rsp + 0x40]
call fcn.140019b30
test al, al
je 0x14001aef8
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001aef2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001aefa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14001af20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
test r9d, r9d
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
mov rbx, rdx
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov rsi, rcx
cmovne r8, rax
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.14003c608
lea r8, [0x14006a5f0]
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.14003c584
mov r8, rbx
lea rcx, [rsp + 0x40]
mov edx, 0x200
call fcn.14003c584
lea r8, str.Properties
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.14003c584
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001afed
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov al, 1
jmp 0x14001b022
test byte [rsi + 0x298], 1
je 0x14001b020
mov r9d, eax
lea r8, str.Cannot_Open_EndpointProperty_Key__x_r_n
mov edx, 0x400
lea rcx, [rsp + 0x440]
call fcn.140002050
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140024cf0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14001b050
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rdi, r9
mov rbx, r8
mov rsi, rcx
test r9, r9
je 0x14001b153
test rbx, rbx
je 0x14001b153
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b12b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001b0f8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14001b166
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea r8, str.SetRegByKeyName:__s__s_Reg_Set_fail_err_x_n
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.1400171b0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001b164
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea r8, str.SetRegByKeyName:__s__s_Reg_Open_fail_err_x_n
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.1400171b0
jmp 0x14001b164
lea r8, str.SetRegByKeyName:_ValueName_or_SubkeyName_empty_n
mov edx, 1
call fcn.1400171b0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14001b190
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x90]
mov rdi, r9
mov qword [rsp + 0x30], 0
mov rbx, r8
mov dword [rsp + 0x38], 4
mov rsi, rcx
test r9, r9
je 0x14001b2a3
test rbx, rbx
je 0x14001b2a3
test rbp, rbp
je 0x14001b2a3
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b27b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b248
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14001b2b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea r8, str.GetRegByKeyName:__s__s_Reg_Get_fail_err_x_n
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.1400171b0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001b2b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea r8, str.GetRegByKeyName:__s__s_Reg_Open_fail_err_x_n
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.1400171b0
jmp 0x14001b2b4
lea r8, str.GetRegByKeyName:_ValueName_or_SubkeyName_or_pRetValue_empty_n
mov edx, 1
call fcn.1400171b0
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001b2d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, qword [rsp + 0x480]
lea rcx, [rsp + 0x40]
mov rbx, r8
xor edx, edx
mov r8d, 0x400
mov rsi, r9
call fcn.140028230
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x200
mov r9d, 0x2001b
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b3b9
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b3ae
test rdi, rdi
je 0x14001b39c
movsxd rdx, dword [rsp + 0x488]
lea r9, [rsp + 0x40]
add rdx, rdx
lea r8, [0x140068228]
mov rcx, rdi
call fcn.140002050
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14001b3bb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140024cf0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14001bf90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x40]
mov esi, r9d
call fcn.140028230
mov r9d, esi
mov dword [rsp + 0x38], 0x200
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call fcn.14001af20
test al, al
je 0x14001c055
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.b3f8fa53_0004_438e_9003_51a46e139bfc_2
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c04c
test rbp, rbp
je 0x14001c03f
lea r9, [rsp + 0x40]
mov edx, 0x200
lea r8, [0x140068228]
mov rcx, rbp
call fcn.140002050
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001c057
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001e660
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor r14d, r14d
mov dword [rsp + 0x38], 4
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], r14
mov rsi, rdx
mov dword [rsp + 0x3c], r14d
mov rdi, rcx
mov ebx, 0xffffffff
lea r9d, [r14 + 1]
call fcn.14001af20
test al, al
jne 0x14001e6df
test byte [rdi + 0x298], 1
je 0x14001e868
lea rcx, str.Metering::Is_ren_RTK_speak_or_headphone__No_Render_Endpoint_Property_Key_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14001e868
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.1da5d803_d492_4edd_8c23_e0c0ffee7f0e_0
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e868
mov rcx, qword [rsp + 0x30]
lea ebx, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x3c], ebx
jne 0x14001e868
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.14003c608
lea r8, [0x14006a5f0]
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.14003c584
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x200
call fcn.14003c584
lea r8, str.FxProperties
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.14003c584
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001e868
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_4
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xff
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x48], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_1
lea rax, [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_6
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], r14d
jne 0x14001e854
cmp dword [rsp + 0x44], r14d
jne 0x14001e854
mov ebx, r14d
jmp 0x14001e85d
cmp dword [rsp + 0x48], r14d
cmovne ebx, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140024cf0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140021d58
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rbp, rcx
mov qword [r11 - 0x40], rcx
mov qword [r11 - 0x38], rdx
mov dword [r11 - 0x30], r8d
mov edx, 0x102
call fcn.140022484
mov rsi, rax
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140021da9
mov rdx, qword [rdi]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
test ebx, ebx
jne 0x140021dde
lea esi, [rbx + 1]
mov rcx, rbp
call fcn.140009e30
nop
mov rcx, rdi
call fcn.140009e30
mov eax, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140021e10
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov qword [r11 - 0x50], rcx
mov qword [r11 - 0x48], rdx
mov qword [r11 - 0x40], r8
mov edx, 0x102
call fcn.140022484
mov rbp, rax
mov rax, qword [rsi + 0x10]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140021e67
mov rcx, qword [rsi]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140021e74
mov rdx, qword [rdi]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
test ebx, ebx
jne 0x140021eaa
lea ebp, [rbx + 1]
mov rcx, r14
call fcn.140009e30
nop
mov rcx, rdi
call fcn.140009e30
nop
mov rcx, rsi
call fcn.140009e30
mov eax, ebp
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140022500
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov qword [r11 - 0x60], rcx
mov qword [r11 - 0x58], rdx
mov qword [r11 - 0x50], r8
mov edx, 0x102
call fcn.140022484
mov r15, rax
mov rcx, qword [rdi + 0x10]
add rcx, 2
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400252d4
mov r14, rax
mov rdx, qword [rdi + 0x10]
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x140022581
mov rax, qword [rdi]
lea r8, [rdx + rdx]
lea rcx, [r8 + 4]
cmp rdx, rcx
ja 0x140022642
mov rdx, rax
mov rcx, r14
call fcn.140027dd0
mov rax, qword [rdi + 0x10]
xor r12d, r12d
mov word [r14 + rax*2], r12w
mov rax, qword [rdi + 0x10]
mov word [r14 + rax*2 + 2], r12w
mov rax, qword [rdi + 0x10]
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400225c4
mov rdx, qword [rsi]
lea eax, [rax*2 + 4]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 7
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov edx, 2
mov rcx, r14
call fcn.140024d14
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rbp
call fcn.140009e30
nop
mov rcx, rsi
call fcn.140009e30
nop
mov rcx, rdi
call fcn.140009e30
test ebx, ebx
je 0x14002263b
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x14002261f
call fcn.14002aa04
nop

Function at 0x140022648
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rsi, rcx
mov qword [r11 - 0x40], rcx
mov qword [r11 - 0x38], rdx
mov edx, 0x101
call fcn.140022484
mov rbp, rax
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140022695
mov rdx, qword [rdi]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
mov rcx, rsi
call fcn.140009e30
nop
mov rcx, rdi
call fcn.140009e30
mov al, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400226f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp - 1], rax
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov qword [rbp - 9], rcx
mov qword [rbp - 0x39], rdx
mov qword [rbp - 0x31], r8
movdqa xmm6, xmmword [0x1400712e0]
movdqu xmmword [rbp - 0x19], xmm6
xor r13d, r13d
mov word [rbp - 0x29], r13w
mov edx, 0x101
mov rcx, r14
call fcn.140022484
mov r15, rax
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14002277a
mov rdx, qword [rsi]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 9]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400227b1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rdi], xmm0
jmp 0x1400228a3
cmp dword [rbp - 9], 1
jne 0x14002279c
mov ecx, dword [rbp - 0x41]
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400252d4
mov r12, rax
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400227eb
mov rdx, qword [rsi]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140022829
mov edx, 2
mov rcx, r12
call fcn.140024d14
jmp 0x1400227a5
mov ecx, dword [rbp - 0x41]
mov eax, ecx
shr rax, 1
cmp word [r12 + rax*2 - 2], r13w
jne 0x14002283f
add ecx, 0xfffffffe
mov dword [rbp - 0x41], ecx
mov r8d, ecx
shr r8, 1
movdqa xmm0, xmmword [0x1400712e0]
movdqu xmmword [rbp - 0x59], xmm0
mov word [rbp - 0x69], r13w
mov rdx, r12
lea rcx, [rbp - 0x69]
call fcn.14000a2c0
lea rcx, [rbp - 0x29]
call fcn.140009e30
movups xmm7, xmmword [rbp - 0x69]
movups xmmword [rbp - 0x29], xmm7
movups xmm6, xmmword [rbp - 0x59]
movdqa xmm0, xmmword [0x1400712e0]
movdqu xmmword [rbp - 0x59], xmm0
mov word [rbp - 0x69], r13w
lea rcx, [rbp - 0x69]
call fcn.140009e30
mov edx, 2
mov rcx, r12
call fcn.140024d14
movups xmmword [rdi], xmm7
movdqa xmm0, xmmword [0x1400712e0]
mov word [rbp - 0x29], r13w
movdqu xmmword [rbp - 0x19], xmm0
movups xmmword [rdi + 0x10], xmm6
lea rcx, [rbp - 0x29]
call fcn.140009e30
nop
mov rcx, r14
call fcn.140009e30
nop
mov rcx, rsi
call fcn.140009e30
mov rax, rdi
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140024cf0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022908
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rbx, r8
mov rsi, rdx
mov r13, rcx
mov qword [rbp - 0x31], rcx
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], rdx
mov qword [rbp - 9], rbx
mov edx, 0x102
call fcn.140022484
mov qword [rbp - 0x29], rax
mov r14d, 1
mov r15, qword [rbx + 8]
mov rdi, qword [rbx]
jmp 0x140022994
mov rdx, rdi
lea rcx, [rbp - 1]
call fcn.140013b50
mov rax, qword [rbp + 0xf]
inc rax
add r14, rax
lea rcx, [rbp - 1]
call fcn.140009e30
add rdi, 0x20
cmp rdi, r15
jne 0x140022971
mov eax, 2
mul r14
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400252d4
mov r15, rax
xor eax, eax
mov edi, eax
mov r12, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rbp - 0x39], rax
cmp r12, rax
je 0x140022a2c
mov rdx, r12
lea rcx, [rbp - 1]
call fcn.140013b50
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
mov r13, qword [rbp + 0xf]
lea rax, [r14 + r14]
cmp r13, rax
ja 0x140022b10
lea r8, [r13*2]
lea rcx, [r15 + rdi*2]
call fcn.140027dd0
add rdi, r13
xor eax, eax
mov word [r15 + rdi*2], ax
inc rdi
lea rcx, [rbp - 1]
call fcn.140009e30
add r12, 0x20
cmp r12, qword [rbp - 0x39]
jne 0x1400229cb
mov r13, qword [rbp - 0x31]
xor r12d, r12d
mov word [r15 + rdi*2], r12w
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140022a41
mov rdx, qword [rsi]
lea eax, [r14 + r14]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, 7
xor r8d, r8d
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 2
mov rcx, r15
call fcn.140024d14
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r13
call fcn.140009e30
nop
mov rcx, rsi
call fcn.140009e30
nop
mov rdi, qword [rbx]
test rdi, rdi
je 0x140022ae9
mov rsi, qword [rbx + 8]
jmp 0x140022aa5
mov rcx, rdi
call fcn.140009e30
add rdi, 0x20
cmp rdi, rsi
jne 0x140022a99
mov rcx, qword [rbx]
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x140022ad9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022b16
mov rcx, r8
call fcn.140024d14
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002aa04
nop
call fcn.14002aa04
int3