joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012680
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov rax, rcx
xor edi, edi
test edx, edx
cmovs edx, edi
mov cl, byte [rsp + 0x88]
mov byte [rsp + 7], cl
test r8d, r8d
cmovns edi, r8d
mov ecx, dword [rsp + 0x80]
mov ebp, dword [rax + 0x178]
lea r8d, [rbp - 1]
cmp ebp, r9d
cmovg r8d, r9d
movsxd rbx, dword [rax + 0x174]
lea r11d, [rbx - 1]
cmp ebx, ecx
cmovg r11d, ecx
cmp edi, r11d
jg 0x1400127f9
mov r9d, edx
shr r9d, 1
mov r13d, r8d
shr r13d, 0x1f
add r13d, r8d
sar r13d, 1
add r13d, 1
cmp r9d, r13d
mov esi, r13d
cmovg esi, r9d
mov edi, edi
cmp rdi, rbx
jge 0x1400127f9
mov ebx, edx
mov r15, rbx
shr r15, 1
add esi, r15d
sub esi, r9d
add esi, 1
lea r10d, [r8 + 1]
add r11d, 1
lea rcx, [r15 + r15*4]
lea r12, [rcx*4 + 4]
mov qword [rsp + 0x10], rbx
lea rcx, [rbx + rbx*4]
lea rcx, [rcx*4 + 4]
mov qword [rsp + 8], rcx
nop word cs:[rax + rax]
nop
mov rcx, qword [rax + 0x28]
mov rcx, qword [rcx + rdi*8]
test byte [rcx], 3
je 0x1400127a0
cmp r9d, r13d
jg 0x1400127e0
mov rbp, r12
mov rcx, r15
nop dword [rax + rax]
movsxd rbx, dword [rax + 0x178]
cmp rcx, rbx
jge 0x1400127e0
mov rbx, qword [rax + 0x28]
mov rbx, qword [rbx + rdi*8]
mov rbx, qword [rbx + 0x18]
or dword [rbx + rbp], 0x3ffff
add rcx, 1
add rbp, 0x14
cmp rsi, rcx
jne 0x140012770
jmp 0x1400127e0
cmp edx, r8d
jg 0x1400127e0
mov rbp, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
nop
movsxd rcx, dword [rax + 0x178]
cmp r14, rcx
jge 0x1400127e0
mov rcx, qword [rax + 0x28]
mov rcx, qword [rcx + rdi*8]
mov rcx, qword [rcx + 0x18]
or dword [rcx + rbp], 0x3ffff
add r14, 1
add rbp, 0x14
cmp r10, r14
jne 0x1400127b0
nop dword [rax]
add rdi, 1
cmp rdi, r11
je 0x1400127f9
movsxd rcx, dword [rax + 0x174]
cmp rdi, rcx
jl 0x140012750
cmp byte [rsp + 7], 0
je 0x140012818
mov rcx, rax
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14000d9f0
cmp byte [rax + 0x10e9], 0
je 0x140012832
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rax + 0x10e9], 1
lea rcx, [0x14001aaa0]
mov rdx, rax
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14002bba0
Function at 0x1400228d0
Capabilities:
Hide graphical window

Disassembly:
push rsi
sub rsp, 0x30
mov rcx, qword [0x140102db8]
mov qword [rsp + 0x20], 0
lea r9, [fcn.140022920]
mov edx, 0x6f
xor r8d, r8d
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, rsi
add rsp, 0x30
pop rsi
jmp qword [sym.imp.USER32.dll_DestroyWindow]

Function at 0x140023720
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov rcx, qword [0x140104278]
test rcx, rcx
jne 0x140023771
mov rcx, qword [0x140102db8]
mov qword [rsp + 0x20], 0
lea r9, [0x140023780]
mov edx, 0x6e
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov qword [0x140104278], rax
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140104278]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_SetActiveWindow]
Function at 0x14002a660
Capabilities:
Hide graphical window

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
cmp byte [0x1401054b0], 0
je 0x14002a889
mov edi, r8d
mov ebx, edx
mov r14, rcx
cmp qword [0x1401054b8], 0
jne 0x14002a78a
cmp word [0x1401054c0], 0
jne 0x14002a719
mov dword [rsp + 0x80], 3
lea rax, [0x14002a8b0]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 0
mov rax, qword [0x140102db8]
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rax, str.SizeTipClass
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_RegisterClassA]
mov word [0x1401054c0], ax
mov rsi, qword [sym.imp.USER32.dll_GetSysColor]
mov ecx, 0x18
call rsi
mov dword [0x1401054c4], eax
mov ecx, 0x17
call rsi
mov dword [0x1401054c8], eax
lea rcx, [rsp + 0x84]
mov r8d, 0x154
xor edx, edx
call fcn.1400a7760
mov dword [rsp + 0x80], 0x158
lea r8, [rsp + 0x80]
mov ecx, 0x29
mov edx, 0x158
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
lea rcx, [rsp + 0x15c]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov qword [0x1401054d0], rax
lea rdx, str._dx_d
lea rcx, [rsp + 0x80]
mov r8d, ebx
mov r9d, edi
call fcn.140001000
mov rcx, qword [0x1401054b8]
test rcx, rcx
je 0x14002a7c3
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x14002a889
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rbx, rax
lea r15, [rsp + 0x80]
mov rcx, r15
call fcn.1400b6330
lea r9, [rsp + 0x78]
mov rcx, rbx
mov rdx, r15
mov r8d, eax
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rdx, [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x6c]
cmp eax, 0x11
mov edx, 0x10
cmovl eax, edx
mov ebx, dword [rsp + 0x78]
mov esi, dword [rsp + 0x7c]
sub ecx, esi
cmp ecx, 0x11
cmovl ecx, edx
mov rdi, qword [0x140102db8]
movzx edx, word [0x1401054c0]
mov qword [rsp + 0x50], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x58], 0
mov ecx, 0x88
mov r8, r15
mov r9d, 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1401054b8], rax
mov rcx, rax
mov edx, 4
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.1400a5f20
nop
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002b1b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov eax, dword [rcx + 8]
test eax, eax
je 0x14002b1ea
cmp eax, 2
je 0x14002b1fa
cmp eax, 1
jne 0x14002b26a
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140047900
mov rcx, rsi
call fcn.14002abd0
mov eax, dword [rsi + 8]
cmp eax, 2
jne 0x14002b1c8
mov r9, qword [rsi]
test r9, r9
jne 0x14002b21e
lea rcx, str.ctx__lgfp
lea rdx, str._home_simon_mem_.build_workdirs_bob_aew3xwii_putty_logging.c
mov r8d, 0x2f
call fcn.1400b215c
mov r9, qword [rsi]
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
mov edx, 1
call fcn.1400b4a78
cmp rax, qword [rdi + 8]
jae 0x14002b26a
mov rcx, qword [rsi]
test rcx, rcx
je 0x14002b249
call fcn.1400b3fcc
mov qword [rsi], 0
mov dword [rsi + 8], 3
mov rcx, qword [rsi + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.Disabled_writing_session_log_due_to_error_while_writing
add rsp, 0x28
pop rdi
pop rsi
jmp rax
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14002bd70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov rbx, rdx
mov edi, ecx
cmp qword [0x140105520], 0
jne 0x14002bdbd
lea rcx, [0x14002bfd0]
call fcn.140042470
mov qword [0x140105520], rax
lea rcx, [0x14002c030]
call fcn.140042470
mov qword [0x140105528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140105518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140105518], eax
test edi, edi
mov esi, 1
cmovne esi, edi
add esi, eax
mov ecx, 1
mov edx, 0x18
xor r8d, r8d
call fcn.1400416b0
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], r14
mov dword [rax + 0x10], esi
mov eax, dword [0x140105518]
mov dword [rdi + 0x14], eax
mov rcx, qword [0x140105520]
mov rdx, rdi
call fcn.140042550
cmp rdi, rax
je 0x14002be1b
mov rcx, rdi
call fcn.140041750
jmp 0x14002be2b
mov rdx, qword [rdi + 8]
mov rcx, qword [0x140105528]
call fcn.140042550
mov rcx, qword [0x140105520]
xor edx, edx
call fcn.140042cc0
cmp rax, rdi
jne 0x14002be46
mov ecx, dword [rdi + 0x10]
call fcn.140006f70
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002be70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
cmp qword [0x140105520], 0
jne 0x14002beb6
lea rcx, [0x14002bfd0]
call fcn.140042470
mov qword [0x140105520], rax
lea rcx, [0x14002c030]
call fcn.140042470
mov qword [0x140105528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140105518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140105518], eax
mov rcx, qword [0x140105520]
xor ebx, ebx
xor edx, edx
call fcn.140042cc0
test rax, rax
je 0x14002bf5c
mov rdi, rax
jmp 0x14002bf0e
mov rcx, qword [0x140105520]
xor edx, edx
call fcn.140043320
mov rcx, rdi
call fcn.140041750
mov rcx, qword [0x140105520]
xor ebx, ebx
xor edx, edx
call fcn.140042cc0
mov rdi, rax
test rax, rax
je 0x14002bf5c
mov rdx, qword [rdi + 8]
mov rcx, qword [0x140105528]
xor r8d, r8d
call fcn.140043230
test rax, rax
je 0x14002bee0
mov ecx, dword [0x140105518]
mov ebx, dword [rdi + 0x10]
mov edx, dword [rdi + 0x14]
add edx, 0xfffffff6
sub ecx, edx
mov eax, ebx
sub eax, edx
cmp ecx, eax
jbe 0x14002bf58
mov rcx, qword [0x140105520]
xor edx, edx
call fcn.140043320
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call qword [rdi]
jmp 0x14002beee
mov dword [rsi], ebx
mov bl, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002e620
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov r14, rcx
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x107
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rcx, rdi
call fcn.1400b6330
mov word [rsp + rax + 0x50], 0x2a5c
mov byte [rsp + rax + 0x52], 0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x14002e6c0
mov rdi, rax
lea rbx, [rsp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rcx, rbx
mov edx, 0x140
call r14
mov rcx, rdi
mov rdx, rbx
call rsi
test eax, eax
jne 0x14002e6a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
mov edx, 4
call r14
lea rcx, [rsp + 0x30]
mov edx, 0x20
call fcn.14002e4d0
test al, al
je 0x14002e707
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov edx, 0x20
call r14
mov edx, 0x20
mov rcx, rdi
call fcn.14006dd10
mov rcx, r14
call fcn.14003ba00
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400a5f20
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002e730
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x78], rax
lea rsi, [rsp + 0x78]
mov ecx, 9
mov rdx, rsi
mov r8d, 8
call fcn.14002e200
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsp + 0x78], rax
mov ecx, 0xa
mov rdx, rsi
mov r8d, 8
call fcn.14002e200
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsp + 0x78], rax
mov ecx, 0xb
mov rdx, rsi
mov r8d, 8
call fcn.14002e200
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x74]
mov ecx, 0xc
mov r8d, 4
call fcn.14002e200
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov rdx, rsi
mov r8d, 8
call fcn.14002e200
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov rdx, rsi
mov r8d, 0x38
call fcn.14002e200
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov rdx, rbx
mov r8d, 0x20
call fcn.14002e200
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov rdx, rbx
mov r8d, 0x20
call fcn.14002e200
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400a5f20
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140034fe0
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x38
call fcn.14003f720
cmp byte [rax], 0
je 0x140035004
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.1400477e0
mov rcx, rsi
mov edx, 0x39
call fcn.14003f4d0
test al, al
je 0x14003501f
add rsp, 0x20
pop rsi
jmp fcn.14006f2b0
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x140036fc0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, dword [rsp + 0x70]
mov rcx, r8
mov edx, r9d
call fcn.14003f590
cmp eax, 1
je 0x14003702c
cmp eax, 2
je 0x140037035
cmp eax, 3
jne 0x14003703e
mov rcx, rbx
mov edx, ebp
call fcn.14003f720
lea rcx, str.custom:
mov rdx, rax
xor r8d, r8d
call fcn.140040840
mov rbx, rax
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14003ab60
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140041750
lea r8, str.implicit
jmp 0x140037045
lea r8, str.explicit
jmp 0x140037045
lea r8, str.none
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003ab60
Function at 0x14003ab60
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
test rcx, rcx
je 0x14003ab9e
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.1400b6330
add eax, 1
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov rdx, rsi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003abb0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r8d
test rcx, rcx
je 0x14003abf1
mov rcx, qword [rcx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a5f20
nop
add rsp, 0x48
ret

Function at 0x14003ad10
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x14003ade9
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
lea r15, [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
xor esi, esi
lea r9, [rsp + 0x34]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003adeb
cmp dword [rsp + 0x34], 1
jne 0x14003adeb
mov r14d, dword [rsp + 0x30]
add r14d, 1
mov edx, 1
mov rcx, r14
xor r8d, r8d
call fcn.1400416b0
mov rsi, rax
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003ade1
cmp dword [rsp + 0x34], 1
jne 0x14003ade1
mov eax, dword [rsp + 0x30]
cmp eax, r14d
jb 0x14003add9
lea rcx, str.size___allocsize
lea rdx, str._home_simon_mem_.build_workdirs_bob_aew3xwii_putty_windows_storage.c
mov r8d, 0x92
call fcn.1400b215c
mov eax, dword [rsp + 0x30]
mov eax, eax
mov byte [rsi + rax], 0
jmp 0x14003adeb
mov rcx, rsi
call fcn.140041750
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a5f20
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14003ae10
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov esi, r8d
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 4
test rcx, rcx
je 0x14003ae71
mov rcx, qword [rcx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x3c]
xor ecx, 4
mov edx, dword [rsp + 0x44]
xor edx, 4
or ecx, eax
or ecx, edx
jne 0x14003ae71
mov esi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a5f20
mov eax, esi
add rsp, 0x50
pop rsi
ret
Function at 0x14003ae90
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.14003ad10
test rax, rax
je 0x14003b077
mov r14, rax
lea rdx, str.IsBold
mov rcx, rsi
xor r8d, r8d
call fcn.140040840
mov rdi, rax
mov dword [rsp + 0x44], 4
test rbx, rbx
je 0x14003b063
mov rcx, qword [rbx]
lea r15, [rsp + 0x44]
mov qword [rsp + 0x28], r15
lea r12, [rsp + 0x48]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x4c]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003b063
cmp dword [rsp + 0x44], 4
jne 0x14003b063
cmp dword [rsp + 0x4c], 4
jne 0x14003b063
mov ebp, dword [rsp + 0x48]
mov rcx, rdi
call fcn.140041750
cmp ebp, 0xffffffff
je 0x14003b06b
mov dword [rsp + 0x3c], ebp
lea rdx, str.CharSet
xor edi, edi
mov rcx, rsi
xor r8d, r8d
call fcn.140040840
mov rbp, rax
mov dword [rsp + 0x44], 4
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x4c]
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r12d, eax
mov r13d, dword [rsp + 0x44]
mov r15d, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x40], eax
mov rcx, rbp
call fcn.140041750
test r12d, r12d
jne 0x14003b06d
cmp r13d, 4
jne 0x14003b06d
cmp r15d, 4
jne 0x14003b06d
mov r13d, dword [rsp + 0x40]
cmp r13d, 0xffffffff
je 0x14003b06d
lea rdx, [0x1400e2165]
xor edi, edi
mov rcx, rsi
xor r8d, r8d
call fcn.140040840
mov rbp, rax
mov dword [rsp + 0x44], 4
mov rcx, qword [rbx]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
mov rdx, rbp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov esi, dword [rsp + 0x44]
mov r12d, dword [rsp + 0x4c]
mov r15d, dword [rsp + 0x48]
mov rcx, rbp
call fcn.140041750
test ebx, ebx
jne 0x14003b06d
cmp esi, 4
jne 0x14003b06d
cmp r12d, 4
jne 0x14003b06d
cmp r15d, 0x80000000
je 0x14003b06d
cmp dword [rsp + 0x3c], 0
setne dl
mov rcx, r14
mov r8d, r15d
mov r9d, r13d
call fcn.140053d50
mov rdi, rax
jmp 0x14003b06d
mov rcx, rdi
call fcn.140041750
xor edi, edi
mov rcx, r14
call fcn.140041750
jmp 0x14003b079
xor edi, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a5f20
mov rax, rdi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003b0a0
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x14003b13c
mov rdi, qword [r14]
mov rcx, rdi
call fcn.1400b6330
add eax, 1
mov rcx, qword [rsi]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r15, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, rbx
xor r8d, r8d
mov r9d, 1
call r15
lea rdx, str.IsBold
mov rcx, rbx
xor r8d, r8d
call fcn.140040840
mov rdi, rax
movzx eax, byte [r14 + 8]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsi]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rdx, rdi
xor r8d, r8d
mov r9d, 4
call r15
jmp 0x14003b151
lea rdx, str.IsBold
mov rcx, rbx
xor r8d, r8d
call fcn.140040840
mov rdi, rax
mov rcx, rdi
call fcn.140041750
lea rdx, str.CharSet
mov rcx, rbx
xor r8d, r8d
call fcn.140040840
mov rdi, rax
mov eax, dword [r14 + 0x10]
mov dword [rsp + 0x34], eax
test rsi, rsi
je 0x14003b1a2
mov rcx, qword [rsi]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rdx, rdi
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call fcn.140041750
lea rdx, [0x1400e2165]
mov rcx, rbx
xor r8d, r8d
call fcn.140040840
mov rdi, rax
mov eax, dword [r14 + 0xc]
mov dword [rsp + 0x34], eax
test rsi, rsi
je 0x14003b1f3
mov rcx, qword [rsi]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rdx, rdi
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call fcn.140041750
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a5f20
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14003b260
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
test rcx, rcx
je 0x14003b29e
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [r8]
mov rcx, rbx
call fcn.1400b6330
add eax, 1
mov rcx, qword [rdi]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov rdx, rsi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003b2e0
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdx, str.SoftwareSimonTathamPuTTYSessions
lea r8, [rsp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x14003b351
call fcn.140041ca0
mov rdi, rax
mov rcx, rsi
mov rdx, rax
call fcn.14006f4b0
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, rdi
call fcn.140041da0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14002a260
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a5f20
nop
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14003b3f0
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x105
mov edi, 0x105
mov ecx, 0x105
mov edx, 1
xor r8d, r8d
call fcn.1400416b0
mov rbx, rax
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov r8, rax
mov r9d, 0x105
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0xea
jne 0x14003b4a4
lea r15, [rsp + 0x30]
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
nop
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rcx, rbx
mov rdx, r15
mov r9, rdi
call fcn.140041760
mov rbx, rax
mov r9d, dword [rsp + 0x30]
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov r8, rax
call r12
cmp eax, 0xea
jne 0x14003b4a4
mov rdi, qword [rsp + 0x30]
jmp 0x14003b460
mov ebp, eax
test eax, eax
jne 0x14003b4b5
mov rcx, rbx
mov rdx, r14
call fcn.14006f550
test ebp, ebp
sete dil
add dword [rsi + 8], 1
mov rcx, rbx
call fcn.140041750
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a5f20
mov eax, edi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret