joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003ca74
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
lea rdx, [0x100025f30]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003cb3c
xor ebx, ebx
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x10003cb10
lea rax, [rsp + 0x50]
inc ebx
test rax, rax
je 0x10003caf6
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 1]
call fcn.10003c84c
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10003cada
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x100025f30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x270
pop rbx
ret

Function at 0x10003cb70
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor edi, edi
mov esi, edx
test rcx, rcx
je 0x10003ccb3
mov qword [rsp + 0x20], rcx
lea r9, [0x100026028]
lea r8, [0x100025e98]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call fcn.10003a080
test eax, eax
js 0x10003ccb3
and qword [rsp + 0x48], rdi
mov ebx, 0x20019
call fcn.100063fcc
test eax, eax
mov ecx, 0x20119
lea rax, [rsp + 0x48]
cmovne ebx, ecx
lea rdx, [rsp + 0x260]
xor r8d, r8d
mov r9d, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003ccb3
xor ebx, ebx
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x10003cc87
lea rcx, [rsp + 0x50]
inc ebx
call qword [sym.imp.msvcrt.dll__wcslwr]
cmp word [rsp + 0x50], 0x6b
jne 0x10003cc6d
cmp word [rsp + 0x52], 0x62
jne 0x10003cc6d
lea rax, [rsp + 0x50]
test rax, rax
je 0x10003cc6b
lea rcx, [rsp + 0x50]
mov r8d, esi
mov edx, 1
call fcn.10003c84c
mov edi, eax
jmp 0x10003cc6d
xor edi, edi
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10003cc2e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10003d574
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
mov rsi, rcx
and qword [rsp + 0x40], rbx
test rcx, rcx
je 0x10003d67c
lea rax, [rsp + 0x40]
lea rdx, [0x100026190]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003d66b
mov rcx, qword [rsp + 0x40]
and qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
lea edi, [rbx + 1]
xor r8d, r8d
mov rdx, rsi
mov r9d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003d660
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x1000262e8]
xor r8d, r8d
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003d655
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
setne bl
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdi, [0x100006270]
mov ecx, 0x15
repe cmpsw word [rsi], word [rdi]
jne 0x10003d693
lea rcx, [0x100025de0]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
xor ebx, ebx
test rax, rax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10003e2b4
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
je 0x10003e40b
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x10003e40b
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x10003e40b
mov rcx, qword [rdi]
lea rdx, [0x100026c70]
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x10003e3fb
mov rcx, qword [rdi]
mov edx, 0x3a
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x10003e3fb
add rbx, 2
je 0x10003e3fb
mov rcx, rbx
call fcn.100053454
test eax, eax
je 0x10003e3fb
xor r9d, r9d
xor edx, edx
mov rcx, rbx
lea r8d, [r9 + 2]
call fcn.1000629f4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x10003e3fb
lea rcx, [0x10002cb88]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x10003e3b7
lea r9, [rsp + 0x38]
lea r8, [0x1000250e8]
lea rdx, [0x100026c90]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.100062a68
jmp 0x10003e3b9
xor eax, eax
test eax, eax
je 0x10003e3f2
or dword [rsp + 0x20], 0xffffffff
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov r9d, 0x104
mov rcx, rbx
call fcn.1000634dc
mov ebp, eax
test eax, eax
js 0x10003e3f2
lea rdx, [rsp + 0x50]
mov r8d, 1
xor ecx, ecx
call fcn.100063030
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
inc esi
add rdi, 8
cmp esi, dword [rsp + 0x30]
jl 0x10003e31c
mov eax, ebp
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10003e43c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rdx, [0x100026cb0]
call qword [sym.imp.msvcrt.dll_wcsstr]
xor edi, edi
cmp rax, rdi
je 0x10003e514
lea edx, [rdi + 0x3a]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
cmp rax, rdi
je 0x10003e514
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x68]
lea rdx, [0x100026cd0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x10003e514
add rbx, 2
je 0x10003e509
lea rdx, [0x1000062c0]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, edi
je 0x10003e509
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea rdx, [0x100026d20]
lea r9d, [rax + 1]
not rcx
xor r8d, r8d
dec rcx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x10003fe98
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x480
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r8, qword [0x100088820]
xor r14d, r14d
mov rbp, rcx
mov ebx, 1
cmp r8, r14
je 0x10003feee
mov edx, ebx
mov rcx, r8
call fcn.10003f344
mov r8, r14
mov qword [0x100088820], r14
mov rdx, qword [0x100088818]
cmp rdx, r14
je 0x1000400cd
mov rcx, rdx
call fcn.10004fe1c
cmp rax, r14
je 0x1000400cd
mov rcx, rdx
call fcn.10004fe1c
lea rdi, [0x1000062c0]
mov esi, 0x104
cmp qword [rax + 0x60], r14
lea rcx, [rsp + 0x50]
mov edx, esi
cmovne rdi, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
cmp eax, r14d
je 0x1000400c6
lea r8, [0x100027128]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.100039ee4
cmp eax, r14d
jl 0x10003ff90
lea rcx, [rsp + 0x50]
call fcn.100053454
cmp eax, r14d
jne 0x10003ff90
lea rcx, [rsp + 0x50]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, r14d
je 0x10003ff90
lea r8, [0x100027128]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.100039ee4
lea rcx, [rsp + 0x50]
call fcn.100053454
cmp eax, r14d
je 0x1000400c6
cmp rdi, r14
je 0x1000400c6
lea rdx, [0x1000062c0]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
je 0x1000400c6
mov rcx, rdi
call fcn.100053454
cmp eax, r14d
je 0x1000400c6
mov rcx, qword [0x100088070]
mov r9d, 0xff
lea r8, [rsp + 0x260]
lea edx, [r9 - 0x55]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r14d
je 0x1000400c6
movsxd rax, dword [0x100088814]
lea rcx, [rax + rax*2]
mov rax, qword [str.6ij]
add rcx, rcx
mov r12d, dword [rax + rcx*8 + 0x2c]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x402
mov rcx, rbp
mov r13, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
cmp rax, r14
jne 0x100040060
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
mov edx, 0x402
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
mov ecx, 0x48
call fcn.10007faba
cmp rax, r14
je 0x1000400ba
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r12d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov r9, rsi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x260]
mov r8d, 0x402
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, rbp
call fcn.10004f2d8
mov r8, rax
mov qword [0x100088820], rax
jmp 0x1000400cd
mov r8, r14
mov qword [0x100088820], r14
jmp 0x1000400cd
mov r8, qword [0x100088820]
cmp r8, r14
cmove ebx, r14d
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100040460
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
xor ebx, ebx
lea rax, [r11 + 0x20]
lea rdx, [0x1000255f0]
mov qword [r11 - 0x18], rbx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 1
mov qword [r11 + 0x20], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x100040508
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, [0x100025c80]
xor r8d, r8d
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1000404fd
cmp dword [rsp + 0x60], 4
jne 0x1000404fd
cmp dword [rsp + 0x68], 1
sete bl
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x100040518
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x690
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x680], rax
xor r13d, r13d
mov rdi, rcx
mov ebx, 1
cmp qword [0x100088820], r13
jne 0x100040756
mov esi, 0x104
lea rcx, [r11 - 0x448]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
cmp eax, r13d
je 0x100040748
lea r8, [0x100027128]
lea rcx, [rsp + 0x260]
mov rdx, rsi
call fcn.100039ee4
cmp eax, r13d
jl 0x1000405d4
lea rcx, [rsp + 0x260]
call fcn.100053454
cmp eax, r13d
jne 0x1000405d4
lea rcx, [rsp + 0x260]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, r13d
je 0x1000405d4
lea r8, [0x100027128]
lea rcx, [rsp + 0x260]
mov rdx, rsi
call fcn.100039ee4
lea rcx, [rsp + 0x260]
call fcn.100053454
cmp eax, r13d
je 0x100040748
lea rdx, [rsp + 0x50]
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r13d
je 0x100040748
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x50]
mov r8d, 0x103
call fcn.100052a30
lea r11, [rsp + 0x50]
cmp r11, r13
je 0x10004062d
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [0x100025ea8]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.100039ee4
cmp eax, r13d
jl 0x100040748
lea rcx, [rsp + 0x50]
call fcn.100053454
cmp eax, r13d
je 0x100040748
mov rcx, qword [0x100088070]
mov r9d, 0xff
lea r8, [rsp + 0x470]
lea edx, [r9 - 0x55]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r13d
je 0x100040748
movsxd rax, dword [0x100088814]
lea rcx, [rax + rax*2]
mov rax, qword [str.6ij]
add rcx, rcx
mov ebp, dword [rax + rcx*8 + 0x2c]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov edx, ebp
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x402
mov rcx, rdi
mov r12, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
cmp rax, r13
jne 0x1000406e5
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov edx, 0x402
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
mov ecx, 0x48
call fcn.10007faba
cmp rax, r13
je 0x100040743
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebp
lea rcx, [rsp + 0x50]
mov r9, rsi
mov r8d, 0x402
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x260]
mov rdx, rdi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x470]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.10004f2d8
mov qword [0x100088820], rax
jmp 0x10004074f
mov rax, r13
jmp 0x10004073a
mov rax, qword [0x100088820]
cmp rax, r13
cmove ebx, r13d
mov eax, ebx
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100040918
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea rax, [rsp + 0x58]
lea rdx, [0x100027150]
and qword [rsp + 0x58], rbx
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000409c0
mov rcx, qword [rsp + 0x58]
and dword [rsp + 0x48], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
lea rdx, [0x100006270]
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000409b5
cmp dword [rsp + 0x40], 4
jne 0x1000409b5
cmp dword [rsp + 0x48], ebx
sete bl
test ebx, ebx
je 0x1000409b5
lea rdx, [0x1000271d0]
lea ecx, [rax + 4]
call fcn.1000527a0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x100043ad4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100027440]
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov edi, 1
mov qword [rsp + 0x40], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100043bf3
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x100025bc0]
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x48], 8
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x100043be8
cmp dword [rsp + 0x38], 3
jne 0x100043be8
lea rax, [rsp + 0x50]
cmp rax, rsi
je 0x100043b9f
lea rcx, [rsp + 0x50]
mov edx, 0x100
call fcn.100058170
jmp 0x100043ba1
mov eax, esi
cmp eax, esi
je 0x100043be8
mov eax, dword [rsp + 0x30]
shr eax, 0x10
movzx ebx, ax
movzx eax, word [rsp + 0x30]
shl rbx, 0x10
or rbx, rax
mov eax, dword [rsp + 0x34]
shr eax, 0x10
shl rbx, 0x10
movzx ecx, ax
movzx eax, word [rsp + 0x34]
or rbx, rcx
lea rcx, [rsp + 0x50]
shl rbx, 0x10
or rbx, rax
call fcn.100052d68
cmp rax, rbx
cmovb edi, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x100043c20
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x250
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
xorpd xmm6, xmm6
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ebx, ebx
cmp eax, ebx
je 0x100043d1a
lea r8, [0x1000274e8]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.100039ee4
cmp eax, ebx
jl 0x100043d1a
lea rcx, [rsp + 0x20]
call fcn.100053454
cmp eax, ebx
je 0x100043d1a
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x100043ca6
lea rcx, [rsp + 0x20]
call fcn.100054858
mov rbx, rax
lea rcx, [0x100027510]
call fcn.100052d68
cmp rbx, rax
jb 0x100043cc1
movsd xmm6, qword [0x100039d88]
jmp 0x100043d1a
lea rcx, [0x100027530]
call fcn.100052d68
cmp rbx, rax
jb 0x100043cdc
movsd xmm6, qword [0x100039d80]
jmp 0x100043d1a
lea rcx, [0x100027550]
call fcn.100052d68
cmp rbx, rax
jb 0x100043cf7
movsd xmm6, qword [0x100039d78]
jmp 0x100043d1a
lea rcx, [0x100027570]
call fcn.100052d68
cmp rbx, rax
jb 0x100043d12
movsd xmm6, qword [0x100039d70]
jmp 0x100043d1a
movsd xmm6, qword [0x100039d68]
movapd xmm0, xmm6
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x250
pop rbx
ret

Function at 0x100045b68
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
and qword [r11 + 0x10], 0
xor r8d, r8d
lea rax, [r11 + 0x10]
lea rdx, [0x1000255f0]
mov rcx, 0xffffffff80000002
cmp dword [0x1000887ec], r8d
jne 0x100045c36
and qword [r11 - 0x18], r8
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], r8
xor r9d, r9d
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100045bf9
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
lea rdx, [0x1000255f0]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x100045cb0
lea rax, [rsp + 0x60]
mov r9d, 4
lea rdx, [0x100025648]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100045ca5
mov r9d, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100045c68
mov rcx, qword [rsp + 0x68]
lea rdx, [0x100025648]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x68]
lea rdx, [0x1000255f0]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100045cb0
mov rcx, qword [rsp + 0x68]
lea rdx, [0x100025648]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret
Function at 0x10004a9a4
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
xor edi, edi
lea rax, [rsp + 0x78]
lea rdx, [0x100025840]
lea r9d, [rdi + 3]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x78], rdi
mov ebx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10004ab25
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, [0x100025918]
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10004aad7
cmp dword [rsp + 0x68], 0xd2af9
je 0x10004aa43
cmp dword [rsp + 0x68], 0xc00d2afb
jne 0x10004aad7
lea rcx, [rsp + 0x30]
mov ebx, 1
call fcn.10003b0d4
cmp eax, edi
jne 0x10004aac9
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea rdx, [0x100025938]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x60], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10004aac9
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x30], rax
jbe 0x10004aac7
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x30]
lea r9d, [rbx + 2]
lea rdx, [0x100025938]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10004aac9
mov ebx, edi
call fcn.100053c90
cmp eax, edi
cmove ebx, edi
cmp ebx, edi
jne 0x10004ab1a
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea rdx, [0x100025918]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
lea rdx, [0x100025938]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x48
pop rdi
pop rbx
ret