joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140126060
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0xa8
test byte [0x140208438], 4
je 0x140126209
mov rax, qword [0x140208420]
lea r8, [r11 - 0x58]
mov qword [r11 + 0x10], rbx
mov qword [r8], rax
mov rax, qword [0x140208428]
mov qword [r11 - 8], rdi
mov qword [r8 + 8], rax
mov rax, qword [0x140208430]
xor edi, edi
mov qword [r8 + 0x10], rax
mov rax, qword [0x140208438]
test edx, edx
mov qword [r8 + 0x18], rax
mov rax, qword [0x140208440]
mov ebx, edi
mov qword [r8 + 0x20], rax
mov rax, qword [0x140208448]
mov qword [r8 + 0x28], rax
mov rax, qword [0x140208450]
mov qword [r8 + 0x30], rax
mov rax, qword [0x140208458]
mov qword [r8 + 0x38], rax
mov eax, dword [0x140208460]
mov dword [r8 + 0x40], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x5c], edx
cmovne eax, edi
cmp dword [0x14020847c], ebx
mov dword [rsp + 0x50], 0xaeaeaeae
mov dword [rsp + 0x58], eax
jne 0x140126124
lea rdx, [r11 - 0x58]
lea rcx, [0x140208420]
call fcn.140126580
mov ebx, eax
jmp 0x1401261ef
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xb0]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1401261d1
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0x50]
lea rdx, str.CapProperties
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1401261d1
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_successful
lea rcx, [0x140208420]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.140126a00
jmp 0x1401261ef
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_failed
lea rcx, [0x140208420]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.140126a00
mov rdi, qword [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa8
ret
xor eax, eax
add rsp, 0xa8
ret
Function at 0x140126220
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0xa8
test byte [0x140208438], 8
je 0x1401263bc
mov rax, qword [0x140208420]
lea r8, [r11 - 0x58]
mov qword [r11 + 0x10], rbx
mov qword [r8], rax
mov rax, qword [0x140208428]
mov qword [r11 - 8], rdi
mov qword [r8 + 8], rax
mov rax, qword [0x140208430]
xor edi, edi
mov qword [r8 + 0x10], rax
mov rax, qword [0x140208438]
mov ebx, edi
cmp dword [0x14020847c], ebx
mov qword [r8 + 0x18], rax
mov rax, qword [0x140208440]
mov qword [r8 + 0x20], rax
mov rax, qword [0x140208448]
mov qword [r8 + 0x28], rax
mov rax, qword [0x140208450]
mov qword [r8 + 0x30], rax
mov rax, qword [0x140208458]
mov qword [r8 + 0x38], rax
mov eax, dword [0x140208460]
mov dword [r8 + 0x40], eax
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x50], 0xaeaeaeae
jne 0x1401262d7
lea rdx, [r11 - 0x58]
lea rcx, [0x140208420]
call fcn.140126580
mov ebx, eax
jmp 0x1401263a2
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xb0]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140126384
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0x50]
lea rdx, str.CapProperties
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140126384
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_successful
lea rcx, [0x140208420]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.140126a00
jmp 0x1401263a2
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_failed
lea rcx, [0x140208420]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.140126a00
mov rdi, qword [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa8
ret
xor eax, eax
add rsp, 0xa8
ret
Function at 0x1401263d0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0xa8
test byte [0x140208438], 1
je 0x14012656c
mov rax, qword [0x140208420]
lea r8, [r11 - 0x58]
mov qword [r11 + 0x10], rbx
mov qword [r8], rax
mov rax, qword [0x140208428]
mov qword [r11 - 8], rdi
mov qword [r8 + 8], rax
mov rax, qword [0x140208430]
xor edi, edi
mov qword [r8 + 0x10], rax
mov rax, qword [0x140208438]
mov ebx, edi
cmp dword [0x14020847c], ebx
mov qword [r8 + 0x18], rax
mov rax, qword [0x140208440]
mov qword [r8 + 0x20], rax
mov rax, qword [0x140208448]
mov qword [r8 + 0x28], rax
mov rax, qword [0x140208450]
mov qword [r8 + 0x30], rax
mov rax, qword [0x140208458]
mov qword [r8 + 0x38], rax
mov eax, dword [0x140208460]
mov dword [r8 + 0x40], eax
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x50], 0xaeaeaeae
jne 0x140126487
lea rdx, [r11 - 0x58]
lea rcx, [0x140208420]
call fcn.140126580
mov ebx, eax
jmp 0x140126552
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xb0]
lea rdx, str.SoftwareRealtekAEAPO
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140126534
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0x50]
lea rdx, str.CapProperties
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140126534
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_successful
lea rcx, [0x140208420]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.140126a00
jmp 0x140126552
or r9d, 0xffffffff
lea rdx, str.WriteRegistry_failed
lea rcx, [0x140208420]
or r8d, r9d
mov dword [rsp + 0x20], edi
call fcn.140126a00
mov rdi, qword [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa8
ret
xor eax, eax
add rsp, 0xa8
ret
Function at 0x140126580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rdx
or r9d, 0xffffffff
lea rcx, [0x140208420]
lea rdx, str.Start_WriteService
or r8d, r9d
xor ebx, ebx
mov dword [rsp + 0x20], 1
call fcn.140126a00
lea rcx, [0x140208420]
call fcn.1401266b0
test rax, rax
mov rdi, rax
jne 0x1401265fc
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140208420]
call fcn.1401266b0
test rax, rax
mov rdi, rax
je 0x140126665
lea rcx, [rsp + 0x48]
mov rdx, rsi
mov r8d, 0x44
mov dword [rsp + 0x40], 0xae0ae0ae
mov dword [rsp + 0x44], 1
call fcn.1401492a0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x88
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140126651
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
lea rdx, str.WriteService_successful
jne 0x14012666c
lea rdx, str.WriteService_failed
or r9d, 0xffffffff
lea rcx, [0x140208420]
mov dword [rsp + 0x20], 0
or r8d, r9d
call fcn.140126a00
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140144dc0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401266b0
Capabilities:
Start service

Disassembly:
push r12
sub rsp, 0x40
xor r12d, r12d
lea rcx, str..pipeAERTAPOProperties
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140126805
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Cant_open_pipe:
lea rcx, [0x140208420]
or r9d, 0xffffffff
mov r8d, eax
mov dword [rsp + 0x20], r12d
call fcn.140126a00
cmp dword [0x140208480], r12d
je 0x14012673a
mov ebx, 1
mov rax, r12
mov dword [0x140208480], ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
mov qword [rsp + 0x60], rsi
mov ebx, 1
xor edx, edx
xor ecx, ecx
mov r8d, ebx
mov qword [rsp + 0x68], rdi
mov esi, r12d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x1401267f3
lea r8d, [rbx + 0xf]
lea rdx, str.AERTFilters
mov rcx, rax
mov qword [rsp + 0x58], rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbp, rax
je 0x1401267a2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbp
test eax, eax
cmovne esi, ebx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
mov rbp, qword [rsp + 0x58]
je 0x1401267f3
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r12
lea rcx, str..pipeAERTAPOProperties
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, r12
jmp 0x1401267f6
mov rax, r12
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x140127310
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov ecx, dword [rcx + 0x28]
xor ebx, ebx
test ecx, ecx
jne 0x140127337
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x1401273cd
add eax, eax
cmp eax, ecx
jne 0x1401273cd
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareAndrea_ElectronicsAEAudioAPOSettings
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401273cd
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.AEOpts
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401273c2
mov ecx, dword [rsp + 0x60]
mov eax, 1
not ecx
cmp ecx, dword [rdi + 0x28]
cmove ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140127670
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x100
mov esi, edx
lea rax, [rsp + 0x30]
mov rbx, rcx
lea rdx, str.SoftwareRealtekAEAPO
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401277e1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x130]
lea r9, [rsp + 0x138]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.RenProperties
xor r8d, r8d
mov qword [rsp + 0x120], rbp
mov dword [rsp + 0x130], 0x60
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ebp, [rdi + 1]
test eax, eax
jne 0x140127714
cmp dword [rsp + 0x130], 0x60
jne 0x140127714
cmp dword [rsp + 0x40], 0xaee0aee0
cmove edi, ebp
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1401277d9
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8d, 0x60
call fcn.1401492a0
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8d, 0x60
call fcn.1401492a0
or r9d, 0xffffffff
lea rdx, str.LoadEQInfo_successful
mov rcx, rbx
or r8d, r9d
mov dword [rsp + 0x20], 0
call fcn.140127c90
test esi, esi
je 0x1401277d9
mov rax, qword [rbx + 0x60]
test rax, rax
je 0x1401277d9
mov edx, dword [rsp + 0x4c]
cmp edx, dword [rsp + 0xac]
je 0x140127793
mov r8, qword [rbx + 0xa0]
xor ecx, ecx
call rax
mov r8, qword [rbx + 0xa0]
xor edx, edx
mov ecx, ebp
call qword [rbx + 0x60]
mov edx, dword [rsp + 0x48]
cmp edx, dword [rsp + 0xa8]
je 0x1401277bd
mov r8, qword [rbx + 0xa0]
mov ecx, 2
call qword [rbx + 0x60]
mov edx, dword [rsp + 0x78]
cmp edx, dword [rsp + 0xd8]
je 0x1401277d9
mov r8, qword [rbx + 0xa0]
mov ecx, 3
call qword [rbx + 0x60]
mov rbp, qword [rsp + 0x120]
add rsp, 0x100
pop rdi
pop rsi
pop rbx
ret
Function at 0x14012b498
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140141b74
test rax, rax
mov rsi, rax
je 0x14012b515
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test rbx, rbx
movzx edi, ax
je 0x14012b510
cmp dword [rbx], 0x38
jb 0x14012b510
mov rax, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14012b510
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14012b519
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14012c488
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.14013c7e8
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x14012c4bf
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x14012c4bf
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x14012c4ef
test rbx, rbx
je 0x14012c4ef
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14012c4ef
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14012fbdc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xa0], 0
mov rbx, rdx
mov rsi, rcx
jne 0x14012fc94
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8, qword [rbx]
mov edx, 1
mov ecx, dword [r8 - 0xc]
sub edx, dword [r8 - 8]
movsxd rdi, eax
sub ecx, edi
or edx, ecx
jge 0x14012fc2c
mov edx, edi
mov rcx, rbx
call fcn.140002cd0
test edi, edi
mov rdx, qword [rbx]
js 0x14012fc89
cmp edi, dword [rdx - 0xc]
jg 0x14012fc89
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
lea r8d, [rdi + 1]
and word [rax + rdi*2], 0
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14012fc5d
xor eax, eax
jmp 0x14012fc66
call fcn.140148440
test eax, eax
js 0x14012fc7e
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14012fc7e
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
and word [rax + rcx*2], 0
jmp 0x14012fca4
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov ecx, 0x80070057
call fcn.140002cb0
int3
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401327e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x140132848
call fcn.14013c798
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140132848
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x14013286a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14013223c
test rdi, rdi
mov esi, eax
je 0x140132868
test rbx, rbx
je 0x140132868
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140137a7c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x140137b7b
mov r9d, 0x104
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test eax, eax
jne 0x140137b52
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140004b50
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.140137a7c
mov ebx, eax
test eax, eax
setne byte [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140137b39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x20], 0
je 0x140137b42
jmp 0x140137b52
jmp 0x140137ad2
cmp ebx, 0x103
je 0x140137b62
cmp ebx, 0x3f2
jne 0x140137b70
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140144dc0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401386a8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa8], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14013871f
call fcn.140138634
test rax, rax
mov rsi, rax
jne 0x1401386db
mov eax, edi
jmp 0x140138735
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x1401386d7
mov r9, qword [rcx + 0xd0]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140138808
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rdi, r9
mov rbp, r8
cmp qword [rcx + 0xa8], rbx
mov rsi, rdx
je 0x1401388cf
cmp r8, rbx
jne 0x140138863
call fcn.140138530
cmp rax, rbx
mov rdi, rax
jne 0x140138852
xor eax, eax
jmp 0x1401388e5
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rdi
jmp 0x1401388be
cmp r9, rbx
jne 0x140138883
call fcn.140138634
cmp rax, rbx
mov rdi, rax
je 0x14013884b
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14013885e
call fcn.140138634
cmp rax, rbx
mov r12, rax
je 0x14013884b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
xor r8d, r8d
lea eax, [rax + rax + 2]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r12
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
sete bl
mov eax, ebx
jmp 0x1401388e5
mov r9, qword [rcx + 0xd0]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x140138900
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
xor edi, edi
mov rbp, r9
mov r14, r8
cmp qword [rcx + 0xa8], rdi
mov rsi, rdx
mov rbx, rcx
je 0x140138982
call fcn.140138634
cmp rax, rdi
mov rsi, rax
jne 0x140138948
xor eax, eax
jmp 0x140138a10
mov ecx, dword [rsp + 0x70]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rax
mov rdx, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
sete dil
mov eax, edi
jmp 0x140138a10
mov r12d, dword [rsp + 0x70]
mov eax, 2
lea ecx, [r12 + r12 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1401287b0
cmp r12d, edi
mov r9d, edi
mov r13, rax
jbe 0x1401389e9
mov rdx, rax
mov r9, r12
mov r8, r12
mov al, byte [rbp]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
mov al, byte [rbp]
add rdx, 4
shr al, 4
add rbp, 1
movzx ecx, al
add cx, 0x41
sub r8, 1
mov word [rdx - 2], cx
jne 0x1401389bb
lea eax, [r9 + r9]
mov r8, r14
mov rdx, rsi
mov r9, r13
mov rcx, rbx
mov word [r13 + rax*2], di
call fcn.140138808
mov rcx, r13
mov ebx, eax
call fcn.1401287f4
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret