joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f740
Capabilities:
Set registry value

Disassembly:
mov r10, r8
mov rcx, rdx
mov rdx, r10
mov r8, r9
jmp 0x140062470
push rbx
sub rsp, 0x110
movaps xmmword [rsp + 0x100], xmm6
mov rbx, rdx
mov dword [rsp + 0x30], 0
lea rax, [0x1400f2db8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov r10, qword [r8]
mov r9, qword [r8 + 8]
sub r9, r10
mov eax, r9d
cmp rax, r9
jne 0x14006257f
cmp qword [rdx + 0x18], 8
jb 0x1400624bd
mov rdx, qword [rdx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r10
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400624ef
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xe
lea rdx, str.SetBinaryValue
lea rcx, [rsp + 0x40]
call fcn.140007090
nop
movd eax, xmm6
test eax, eax
jne 0x1400625aa
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140062568
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062563
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062579
call fcn.140085050
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
ret
call fcn.14008fffc
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x60]
call fcn.140065470
lea rdx, [0x1400f02f8]
lea rcx, [rsp + 0x60]
call fcn.14008b7f4
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140009cc0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.14006df30
mov rbx, rax
lea r8, [0x1400d3dfc]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x98]
call fcn.140037e90
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140035910
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.14000d910
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140060700
int3
Function at 0x1400611f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp 0x1400611f0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x100
movaps xmmword [rsp + 0xf0], xmm6
mov rbx, rdx
xor esi, esi
mov dword [rsp + 0x30], esi
lea rax, [0x1400f2db8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
cmp qword [rdx + 0x18], 8
jb 0x14006122e
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14006126a
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x140061265
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
xor dil, dil
jmp 0x14006126d
mov dil, 1
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xb
lea rdx, str.ValueExists
lea rcx, [rsp + 0x40]
call fcn.140007090
nop
movd eax, xmm6
test eax, eax
jne 0x140061302
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400612de
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400612d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400612fc
call fcn.140085050
movzx eax, dil
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret
call fcn.14008fffc
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140009cc0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14006df30
mov rbx, rax
lea r8, [0x1400d3dfc]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.140037e90
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140035910
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.14000d910
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140060700
int3
Function at 0x140061560
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rax, [0x1400f2db8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r8
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x44], 4
movups xmmword [r8], xmm0
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x40], 0
jb 0x1400615b7
mov rdx, qword [rdx]
lea rax, [rsp + 0x44]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14006160a
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140085030
add rsp, 0x60
pop rbx
ret
cmp dword [rsp + 0x40], 4
je 0x14006161b
mov dword [rsp + 0x30], 0x65d
jmp 0x1400615e1
cmp dword [rsp + 0x44], 4
je 0x140061631
mov edx, 1
mov rcx, rbx
call fcn.140065000
jmp 0x1400615f5
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140085030
add rsp, 0x60
pop rbx
ret

Function at 0x1400617f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0
lea rax, [0x1400f2db8]
mov qword [rsp + 0x40], rax
mov rbx, r8
movups xmm0, xmmword [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x34], 8
movups xmmword [r8], xmm0
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x30], 0
jb 0x140061848
mov rdx, qword [rdx]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14006189b
mov dword [rsp + 0x38], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx], xmm0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140085030
add rsp, 0x50
pop rbx
ret
cmp dword [rsp + 0x30], 0xb
je 0x1400618ac
mov dword [rsp + 0x38], 0x65d
jmp 0x140061872
cmp dword [rsp + 0x34], 8
je 0x1400618c2
mov edx, 1
mov rcx, rbx
call fcn.140065000
jmp 0x140061886
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140085030
add rsp, 0x50
pop rbx
ret
Function at 0x140061fd0
Capabilities:
Set registry value

Disassembly:
mov r10, r8
mov rcx, rdx
mov rdx, r10
mov r8, r9
jmp 0x140061fd0
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rbp + 8], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov rdx, r8
lea rcx, [rbp - 0x10]
call fcn.140063ae0
nop
mov dword [rsp + 0x30], 0
lea rax, [0x1400f2db8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov rcx, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
sub rcx, r8
mov eax, ecx
cmp rax, rcx
jne 0x14006216c
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140062055
mov rdx, qword [rdi]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r8
mov r9d, 7
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140062089
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400620c3
mov rdx, qword [rbp]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400620be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062197
call fcn.140085050
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov r8d, 0x1e
lea rdx, str.SetMultistringFilterEmptyValue
lea rcx, [rsp + 0x50]
call fcn.140007090
nop
movd eax, xmm6
test eax, eax
jne 0x14006219d
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140062140
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006213b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062166
call fcn.140085050
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140085030
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call fcn.14008fffc
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.140065470
lea rdx, [0x1400f02f8]
lea rcx, [rsp + 0x30]
call fcn.14008b7f4
nop
call fcn.14008fffc
nop
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.140009cc0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14006df30
mov rbx, rax
lea r8, [0x1400d3dfc]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.140037e90
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140035910
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14000d910
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140060700
int3
Function at 0x140062470
Capabilities:
Set registry value

Disassembly:
mov r10, r8
mov rcx, rdx
mov rdx, r10
mov r8, r9
jmp 0x140062470
push rbx
sub rsp, 0x110
movaps xmmword [rsp + 0x100], xmm6
mov rbx, rdx
mov dword [rsp + 0x30], 0
lea rax, [0x1400f2db8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov r10, qword [r8]
mov r9, qword [r8 + 8]
sub r9, r10
mov eax, r9d
cmp rax, r9
jne 0x14006257f
cmp qword [rdx + 0x18], 8
jb 0x1400624bd
mov rdx, qword [rdx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r10
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400624ef
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xe
lea rdx, str.SetBinaryValue
lea rcx, [rsp + 0x40]
call fcn.140007090
nop
movd eax, xmm6
test eax, eax
jne 0x1400625aa
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140062568
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062563
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062579
call fcn.140085050
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
ret
call fcn.14008fffc
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x60]
call fcn.140065470
lea rdx, [0x1400f02f8]
lea rcx, [rsp + 0x60]
call fcn.14008b7f4
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140009cc0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.14006df30
mov rbx, rax
lea r8, [0x1400d3dfc]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x98]
call fcn.140037e90
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140035910
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.14000d910
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140060700
int3

Function at 0x140062c10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [rcx + 0x58]
lea r15, [rcx + 0x60]
mov qword [rsp + 0x88], rsi
mov r13, r9
mov qword [rsp + 0x40], rdi
mov r14, r8
mov rbx, rdx
mov rbp, rcx
cmp qword [r14 + 0x18], 8
mov rdx, r14
jb 0x140062c4d
mov rdx, qword [r14]
mov qword [rsp + 0x28], r15
lea r9, [rbp + 0x64]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140062ca7
cmp eax, 0xea
jne 0x140062c8d
mov esi, dword [rbp + 0x60]
lea rcx, [rbp + 0x40]
mov edx, esi
call fcn.140064f30
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x60], esi
jmp 0x140062c40
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r13], xmm0
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x1400631a0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
mov dword [rsp + 0x20], 0
lea r8, [0x1400f2db8]
mov eax, r9d
mov qword [rsp + 0x28], r8
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
cmp qword [rdx + 0x18], 8
jb 0x1400631d2
mov rdx, qword [rdx]
xor r9d, r9d
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
je 0x14006320a
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x140063202
mov dword [rsp + 0x20], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
xor al, al
add rsp, 0x30
pop rbx
ret
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140063220
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, r9d
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, [0x1400f2db8]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r8], xmm0
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
cmp qword [rdx + 0x18], 8
jb 0x140063288
mov rdx, qword [rdx]
xor r9d, r9d
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea rdx, [0x1400f3490]
test eax, eax
je 0x1400632bf
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x1400632bb
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rdx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
xor al, al
jmp 0x1400632c1
mov al, 1
cmp dword [rsp + 0x30], ebx
je 0x1400633fb
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
mov r9d, 0x3001f
mov r8, r13
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400630e0
nop
mov rbx, qword [rsp + 0x30]
cmp dword [r12], 0
je 0x140063304
xor sil, sil
jmp 0x1400633e9
test rbx, rbx
jne 0x140063311
mov sil, 1
jmp 0x1400633e9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140062dc0
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
cmp dword [r12], 0
jne 0x140063392
mov r14, r15
cmp r15, rbp
je 0x140063420
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14006335a
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x14006336f
lea ecx, [rax - 2]
cmp ecx, 1
ja 0x140063378
add r14, 0x20
cmp r14, rbp
jmp 0x140063347
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r12], xmm0
xor sil, sil
test r15, r15
je 0x1400633e9
mov rdi, r15
cmp r15, rbp
je 0x1400633b3
mov rcx, rdi
call fcn.140006e20
add rdi, 0x20
cmp rdi, rbp
jne 0x1400633a2
mov rdx, qword [rsp + 0x50]
sub rdx, r15
and rdx, 0xffffffffffffffe0
mov rax, r15
cmp rdx, 0x1000
jb 0x1400633e0
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063439
mov rcx, r15
call fcn.140085050
nop
test rbx, rbx
je 0x1400633f7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140085030
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rsi
call fcn.1400631a0
mov sil, 1
jmp 0x140063395
call fcn.14008fffc
int3
Function at 0x140063750
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x38], rcx
xor r12d, r12d
mov dword [rbp - 0x38], r12d
lea rax, [0x1400f2db8]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r8], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
movzx ebx, byte [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
inc rcx
call fcn.140064fc0
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8d, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, eax
test eax, eax
je 0x14006389a
lea edi, [rdx - 1]
mov r8, qword [rbp - 0x18]
lea rcx, [r8 + 1]
cmp rdx, rcx
jbe 0x140063877
cmp rdi, r8
ja 0x140063812
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rdi
mov word [rax + rdi*2], r12w
jmp 0x1400637b0
mov rdx, rdi
sub rdx, r8
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x140063859
mov qword [rbp - 0x18], rdi
lea r9, [rbp - 0x28]
cmp rcx, 8
cmovae r9, qword [rbp - 0x28]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14006384b
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x1400637b0
lfence
mov word [rsp + 0x20], r12w
mov r9, rdx
movzx r8d, bl
lea rcx, [rbp - 0x28]
call fcn.140007e50
jmp 0x1400637b0
lfence
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140006700
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
jmp 0x140063905
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x38], eax
lea rax, [0x1400f3490]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r15], xmm0
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140063905
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063900
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063923
call fcn.140085050
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140085030
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14008fffc
int3
Function at 0x140063930
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [rsp + 0x80]
lea rax, [0x1400f2db8]
mov qword [rsp + 0x38], rax
mov r11d, r8d
mov dword [rsp + 0x30], 0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov r10, qword [r9]
mov r8, qword [r9 + 8]
sub r8, r10
mov eax, r8d
cmp rax, r8
jne 0x1400639b1
cmp qword [rdx + 0x18], 8
jb 0x140063979
mov rdx, qword [rdx]
mov dword [rsp + 0x28], r8d
mov r9d, r11d
xor r8d, r8d
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400639ab
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.140065470
lea rdx, [0x1400f02f8]
lea rcx, [rsp + 0x30]
call fcn.14008b7f4
int3

Function at 0x140063c00
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400f2010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
movzx eax, byte [r8 + 0x20]
cmp al, 1
jne 0x140063c36
mov r8d, dword [r8]
call fcn.140064220
jmp 0x140063d6a
cmp al, 2
jne 0x140063c44
call fcn.140064320
jmp 0x140063d6a
cmp al, 3
jne 0x140063cc6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rdx, r8
lea rcx, [rsp + 0x30]
call fcn.140063ae0
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov r8d, 7
mov rdx, rdi
mov rcx, rbx
call fcn.140063930
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140063d6a
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063cbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063d7f
call fcn.140085050
jmp 0x140063d6a
cmp al, 4
jne 0x140063ce2
mov qword [rsp + 0x20], rsi
mov r9, r8
mov r8d, 3
call fcn.140063930
jmp 0x140063d6a
cmp al, 5
jne 0x140063cf0
mov r8, qword [r8]
call fcn.1400642a0
jmp 0x140063d6a
cmp al, 6
jne 0x140063cfb
call fcn.140064400
jmp 0x140063d6a
test al, al
jne 0x140063d5d
xor ecx, ecx
mov dword [rsp + 0x30], ecx
lea rax, [0x1400f2db8]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x140063d24
mov rdi, qword [rdx]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140063d6a
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
jmp 0x140063d6a
mov edx, 2
mov rcx, rsi
call fcn.140065000
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140085030
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call fcn.14008fffc
int3
Function at 0x140064220
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x1400f2db8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x40], r8d
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x140064255
mov rdx, qword [rdx]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140064292
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret

Function at 0x1400642a0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x1400f2db8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], r8
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x1400642d5
mov rdx, qword [rdx]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140064312
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret

Function at 0x140064320
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x1400f2db8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov r10, rdx
mov rdx, r8
movups xmmword [r9], xmm0
mov r9, qword [r8 + 0x18]
cmp r9, 8
jb 0x140064359
mov rdx, qword [r8]
mov rax, 0xffffffffffffffff
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140064360
lea rdx, [rax*2 + 2]
mov eax, edx
cmp rax, rdx
jne 0x1400643cb
cmp r9, 8
jb 0x140064384
mov r8, qword [r8]
cmp qword [r10 + 0x18], 8
jb 0x14006438e
mov r10, qword [r10]
mov dword [rsp + 0x28], edx
mov r9d, 1
mov qword [rsp + 0x20], r8
mov rdx, r10
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400643c5
mov dword [rsp + 0x30], eax
lea rax, [0x1400f3490]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.140065470
lea rdx, [0x1400f02f8]
lea rcx, [rsp + 0x30]
call fcn.14008b7f4
int3