joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019e44
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rbx, [rcx + 0x522]
mov rdi, rcx
mov rsi, rdx
mov rcx, rbx
call fcn.14005d25c
lea rdx, [0x140098518]
mov r9d, 1
lea r8d, [rax + rax + 2]
mov rcx, rsi
mov dword [rsp + 0x28], r8d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x420]
lea rdx, str.BDAddress
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x426]
lea rdx, str.BDDevClass
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x429]
mov rcx, rbx
call fcn.14005bc90
lea rdx, str.BDName
mov r9d, 1
inc eax
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x73c]
mov ebx, 4
lea rdx, str.UUID
xor r8d, r8d
mov rcx, rsi
mov r9d, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x744]
lea rdx, str.SecurityID
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x748]
lea rdx, str.SecurityLevel
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x740]
lea rdx, [0x140098498]
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x72c]
lea r9d, [rbx - 1]
lea rdx, str.ClassID
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], socket
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x74c]
lea rdx, str.UseMsDevice
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001d2c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rcx + 0x420]
mov rbx, rcx
mov rdi, rdx
lea rcx, [rbp + 0x10]
lea rdx, str.SDLG_LEFT
mov esi, 4
mov qword [r11 - 0x10], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x424]
mov qword [rsp + 0x28], rcx
lea rdx, str.SDLG_TOP
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x428]
lea rdx, str.SDLG_SETTING
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x42c]
lea rdx, str.VDLG_LEFT
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x434]
mov qword [rsp + 0x28], rcx
lea rdx, str.VDLG_TOP
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x430]
lea rdx, str.VDLG_RIGHT
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x438]
lea rdx, str.VDLG_BTTOM
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x43c]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.VDLG_SETTING
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x14001d474
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rcx + 0x420]
mov esi, 4
mov rbx, rcx
lea rdx, str.SDLG_LEFT
xor r8d, r8d
mov r9d, esi
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x424]
lea rdx, str.SDLG_TOP
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x428]
lea rdx, str.SDLG_SETTING
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x42c]
lea rdx, str.VDLG_LEFT
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x434]
lea rdx, str.VDLG_TOP
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x430]
lea rdx, str.VDLG_RIGHT
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x438]
lea rdx, str.VDLG_BTTOM
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x43c]
lea rdx, str.VDLG_SETTING
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001d6c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rcx + 0x420]
mov rbx, rcx
mov rdi, rdx
lea rcx, [rbp + 0x10]
lea rdx, str.UseInquiryFilters
mov esi, 4
mov qword [r11 - 0x10], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x42c]
mov qword [rsp + 0x28], rcx
lea rdx, str.PeriodicInquiry
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x424]
lea rdx, str.InquiryMode
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x428]
lea rdx, str.InquiryDuration
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x43c]
mov qword [rsp + 0x28], rcx
lea rdx, str.InquiryMaxResults
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x434]
lea rdx, str.AutoDiscovery
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x430]
lea rdx, str.PeriodicInquiryRetryTime
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x438]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.InquirySupportedWithConnsUp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x440]
mov qword [rsp + 0x28], rcx
lea rdx, str.ReportNotNamedDevices
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x14001d8a4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rcx + 0x420]
mov esi, 4
mov rbx, rcx
lea rdx, str.UseInquiryFilters
xor r8d, r8d
mov r9d, esi
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x42c]
lea rdx, str.PeriodicInquiry
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x424]
lea rdx, str.InquiryMode
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x434]
lea rdx, str.AutoDiscovery
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x430]
lea rdx, str.PeriodicInquiryRetryTime
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x440]
lea rdx, str.ReportNotNamedDevices
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001d9c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x30
lea rax, [rcx + 0x420]
mov rbx, rcx
lea rcx, [r11 + 8]
mov rdi, rdx
mov qword [r11 - 0x10], rcx
lea rdx, str.Type
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x524]
lea rdx, str.MajorClass
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x528]
mov qword [rsp + 0x28], rcx
lea rdx, str.MinorClass
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x424]
lea rdx, str.BdAddr
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 6
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x42a]
lea rdx, str.BdName
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 0xf8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001daf4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rcx + 0x420]
mov esi, 4
mov rbx, rcx
lea rdx, str.Type
xor r8d, r8d
mov r9d, esi
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x524]
lea rdx, str.MajorClass
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x528]
lea rdx, str.MinorClass
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x424]
mov esi, 3
lea rdx, str.BdAddr
xor r8d, r8d
mov rcx, rdi
mov r9d, esi
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x42a]
lea rdx, str.BdName
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 0xf8
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001dd14
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rcx + 0x424]
mov rbx, rcx
mov rdi, rdx
lea rcx, [rbp + 0x10]
lea rdx, str.AllowOthersToDiscover
mov esi, 4
mov qword [r11 - 0x10], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x420]
mov qword [rsp + 0x28], rcx
lea rdx, str.WhoAllowedToConnect
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x428]
lea rdx, str.InquiryScanMode
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x42c]
lea rdx, str.InquiryScanType
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x430]
mov qword [rsp + 0x28], rcx
lea rdx, str.InquiryScanInterval
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x434]
lea rdx, str.InquiryScanWindow
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x438]
lea rdx, str.PageScanType
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x43c]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.PageScanInterval
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x440]
mov qword [rsp + 0x28], rcx
lea rdx, str.PageScanWindow
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x14001def4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rcx + 0x424]
mov esi, 4
mov rbx, rcx
lea rdx, str.AllowOthersToDiscover
xor r8d, r8d
mov r9d, esi
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x420]
lea rdx, str.WhoAllowedToConnect
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x428]
lea rdx, str.InquiryScanMode
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001dfa4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x30
lea rax, [rcx + 0x520]
mov rbx, rcx
lea rcx, [r11 + 8]
mov rdi, rdx
mov qword [r11 - 0x10], rcx
lea rdx, str.MajorClass
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x524]
lea rdx, str.MinorClass
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x420]
mov qword [rsp + 0x28], rcx
lea rdx, str.BdAddr
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 6
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x426]
lea rdx, str.BdName
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0xf8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001e094
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rcx + 0x520]
mov rbx, rcx
lea rdx, str.MajorClass
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x524]
lea rdx, str.MinorClass
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x420]
lea rdx, str.BdAddr
mov r9d, 3
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x426]
lea rdx, str.BdName
mov r9d, 3
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 0xf8
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001ebb4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [rcx + 0x420]
mov rbx, rcx
lea rcx, [r11 + 8]
mov rdi, rdx
mov qword [r11 - 0x10], rcx
lea rdx, str.InstallSendToExplorer
mov esi, 4
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x40], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x424]
mov qword [rsp + 0x28], rcx
lea rdx, str.InstallSendToIE
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x428]
lea rdx, str.InstallSendToNotes
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x42c]
lea rdx, str.InstallSendToOffice
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x430]
mov qword [rsp + 0x28], rcx
lea rdx, str.InstallSendToWAB
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14001ecd4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rcx + 0x420]
mov esi, 4
mov rbx, rcx
lea rdx, str.InstallSendToExplorer
xor r8d, r8d
mov r9d, esi
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x424]
lea rdx, str.InstallSendToIE
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x428]
lea rdx, str.InstallSendToNotes
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x42c]
lea rdx, str.InstallSendToOffice
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x430]
lea rdx, str.InstallSendToWAB
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001edc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x30
lea rax, [rcx + 0x420]
mov rbx, rcx
lea rcx, [r11 + 8]
mov rdi, rdx
mov qword [r11 - 0x10], rcx
lea rdx, str.Flags
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x424]
lea rdx, [0x14009a158]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001ee54
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rcx + 0x420]
mov r9d, 4
mov rbx, rcx
mov dword [rsp + 0x28], r9d
lea rdx, str.Flags
mov rcx, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rbx, 0x424
mov rcx, rbx
call fcn.14005d25c
lea rdx, [0x14009a158]
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001eed4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
lea r8, [rcx + 0x424]
mov rbx, rcx
lea rdx, [0x140098530]
add rcx, 0x210
call fcn.14005d328
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x420]
mov qword [rsp + 0x28], rcx
lea rdx, str.RefCount
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x428]
lea rdx, str.HwPort
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001ef84
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rcx + 0x420]
mov rbx, rcx
lea rdx, str.RefCount
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x428]
lea rdx, str.HwPort
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret