joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100077080
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov qword [rsp + 0x90], 0xfffffffffffffffe
lea rcx, [rsp + 0x50]
call fcn.100014450
nop
lea rcx, [rsp + 0x68]
call fcn.100014450
nop
mov qword [rsp + 0x58], 0
cmp qword [rsp + 0xb8], 0
jne 0x100077100
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0x68]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x50]
call fcn.1000144b0
nop
mov rcx, qword [rsp + 0xb0]
call fcn.1000144b0
mov eax, dword [rsp + 0x70]
jmp 0x100077259
lea rdx, [0x100010df0]
lea rcx, [rsp + 0x78]
call fcn.100018c00
nop
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x78]
call fcn.100048450
nop
lea rcx, [rsp + 0x78]
call fcn.1000144b0
mov rdx, qword [0x1000a8800]
lea rcx, [rsp + 0x80]
call fcn.100018c00
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.100048450
nop
lea rcx, [rsp + 0x80]
call fcn.1000144b0
lea rcx, [rsp + 0x68]
call fcn.100013ee0
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1000771c8
mov dword [rsp + 0x60], 0
jmp 0x100077211
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [0x1000a8808]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100077209
mov dword [rsp + 0x60], 0
jmp 0x100077211
mov dword [rsp + 0x60], 1
cmp qword [rsp + 0x58], 0
je 0x100077224
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x88], eax
lea rcx, [rsp + 0x68]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x50]
call fcn.1000144b0
nop
mov rcx, qword [rsp + 0xb0]
call fcn.1000144b0
mov eax, dword [rsp + 0x88]
add rsp, 0xa8
ret
Function at 0x10007aca0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x38]
call fcn.100014450
nop
lea rcx, [rsp + 0x50]
call fcn.100014450
nop
lea rdx, [0x100010df0]
lea rcx, [rsp + 0x58]
call fcn.100018c00
nop
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.100048450
nop
lea rcx, [rsp + 0x58]
call fcn.1000144b0
mov rdx, qword [0x1000a8800]
lea rcx, [rsp + 0x60]
call fcn.100018c00
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.100048450
nop
lea rcx, [rsp + 0x60]
call fcn.1000144b0
lea rcx, [rsp + 0x50]
call fcn.100013bb0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x10007adb8
cmp dword [rsp + 0x40], 2
je 0x10007adab
mov rax, qword [rsp + 0x90]
mov r9, qword [rax]
mov r8d, dword [rsp + 0x40]
lea rdx, [0x10000f3a0]
mov ecx, 3
call fcn.100053cc0
jmp 0x10007adb3
mov dword [rsp + 0x40], 0
jmp 0x10007ae57
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1000a8808]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 2
jne 0x10007adf5
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], 0
je 0x10007ae4f
lea rcx, [rsp + 0x50]
call fcn.100013bb0
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x10007ae4f
mov rax, qword [rsp + 0x90]
mov r9, qword [rax]
mov r8d, dword [rsp + 0x40]
lea rdx, [0x10000fe20]
mov ecx, 1
call fcn.100053cc0
jmp 0x10007ae57
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x50]
call fcn.1000144b0
nop
lea rcx, [rsp + 0x38]
call fcn.1000144b0
mov eax, dword [rsp + 0x68]
add rsp, 0x88
ret
Function at 0x10007c170
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov edx, 0x20019
mov rcx, qword [rsp + 0x80]
call fcn.10007c600
test eax, eax
jne 0x10007c1d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10007c3ba
mov rcx, qword [rsp + 0x80]
call fcn.100063930
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x100012040]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10007c22b
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c374
mov rax, qword [rsp + 0x80]
add rax, 0x10
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
je 0x10007c266
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c374
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x10007c2c8
cmp dword [rsp + 0x58], 2
je 0x10007c2b6
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c2be
mov dword [rsp + 0x48], 1
jmp 0x10007c374
mov eax, dword [rsp + 0x30]
add rax, 4
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x10007c30e
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c374
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x10007c35a
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c374
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
call fcn.100054c80
mov dword [rsp + 0x48], 1
cmp qword [rsp + 0x50], 0
je 0x10007c387
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x38], 0
je 0x10007c3a3
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp qword [rsp + 0x40], 0
je 0x10007c3b6
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [rsp + 0x48]
add rsp, 0x78
ret
Function at 0x10007c3d0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov edx, 0x20019
mov rcx, qword [rsp + 0x80]
call fcn.10007c600
test eax, eax
jne 0x10007c436
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10007c5ec
mov rcx, qword [rsp + 0x80]
call fcn.100063930
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x100012040]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10007c48b
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c5a6
mov rax, qword [rsp + 0x80]
add rax, 0x10
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
je 0x10007c4c6
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c5a6
mov rcx, qword [rsp + 0x88]
call fcn.100013ba0
movzx eax, al
test eax, eax
jne 0x10007c565
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x88]
call fcn.10004b610
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x10007c51a
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c5a6
mov eax, dword [rsp + 0x30]
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10007c563
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c5a6
jmp 0x10007c59e
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x10007c59e
cmp dword [rsp + 0x58], 2
je 0x10007c59e
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
jmp 0x10007c5a6
mov dword [rsp + 0x48], 1
cmp qword [rsp + 0x50], 0
je 0x10007c5b9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x38], 0
je 0x10007c5d5
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp qword [rsp + 0x40], 0
je 0x10007c5e8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [rsp + 0x48]
add rsp, 0x78
ret
Function at 0x10007da60
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10007da8e
xor eax, eax
jmp 0x10007dae9
mov rax, qword [rsp + 0x48]
cmp dword [rax + 4], 1
je 0x10007dae4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10007dabc
xor eax, eax
jmp 0x10007dae9
mov eax, dword [rsp + 0x20]
add eax, 0x1f4
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2710
jbe 0x10007dae2
mov ecx, 0x41d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10007dae9
jmp 0x10007da8e
mov eax, 1
add rsp, 0x38
ret
Function at 0x1000801e0
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x268
mov rax, qword [0x1000a81b8]
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x10008022e
mov eax, 1
jmp 0x1000802e7
lea r8, [0x10000748c]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.10004ce90
test eax, eax
jge 0x100080252
mov eax, 1
jmp 0x1000802e7
lea r8, [0x100012610]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.10004ce90
test eax, eax
jge 0x100080273
mov eax, 1
jmp 0x1000802e7
lea r8, [rsp + 0x20]
mov edx, 0x7fffffff
lea rcx, [rsp + 0x40]
call fcn.1000462c0
test eax, eax
jge 0x100080292
mov eax, 1
jmp 0x1000802e7
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x270], 0
je 0x1000802b8
mov eax, dword [rsp + 0x278]
cmp rax, qword [rsp + 0x20]
jae 0x1000802be
mov eax, dword [rsp + 0x20]
jmp 0x1000802e7
mov eax, dword [rsp + 0x278]
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, qword [rsp + 0x270]
call fcn.10001fc80
test eax, eax
jge 0x1000802e5
mov eax, 1
jmp 0x1000802e7
xor eax, eax
mov rcx, qword [rsp + 0x250]
call fcn.100087ed0
add rsp, 0x268
ret
Function at 0x100080310
Capabilities:
Check mutex on windows
Create directory
Get file attributes

Disassembly:
sub rsp, 0xa8
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x58]
call fcn.100080f20
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x10008034e
mov eax, dword [rsp + 0x40]
jmp 0x100080549
lea r8, [0x100012510]
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x10008038c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x58]
call fcn.1000812a0
mov eax, dword [rsp + 0x50]
jmp 0x100080549
lea rcx, [rsp + 0x58]
call fcn.1000812a0
nop
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1000803bc
cmp dword [rsp + 0x40], 0x80
jne 0x1000803c6
mov dword [rsp + 0x44], 1
jmp 0x1000803d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
jmp 0x100080511
cmp dword [0x1000a9638], 0
je 0x1000803eb
mov dword [rsp + 0x50], 0
jmp 0x100080511
mov edx, 0x104
lea rcx, [0x1000a9430]
call fcn.1000801e0
test eax, eax
je 0x10008040d
mov dword [rsp + 0x50], 0x6e
jmp 0x100080511
xor edx, edx
lea rcx, [0x1000a9430]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100080431
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100080511
mov dword [rsp + 0x50], 0
mov dword [0x1000a9638], 1
lea rcx, [0x1000a9430]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x800
test eax, eax
jne 0x100080511
mov qword [rsp + 0x88], 0xffffffffffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, [0x1000a9430]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0xffffffffffffffff
je 0x100080511
mov word [rsp + 0x90], 1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x94]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 2
lea r8, [rsp + 0x90]
mov edx, 0x9c040
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rsp + 0x44], 0
je 0x100080531
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100080531
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0
mov eax, dword [rsp + 0x50]
add rsp, 0xa8
ret
Function at 0x100080aa0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.100018c00
nop
lea rcx, [rsp + 0x70]
call fcn.100048990
movzx eax, al
test eax, eax
jne 0x100080aee
mov dword [rsp + 0x88], 1
jmp 0x100080af9
mov dword [rsp + 0x88], 0
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x68], al
lea rcx, [rsp + 0x70]
call fcn.1000144b0
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x100080b22
mov eax, 0x52
jmp 0x100080c0c
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100080bb7
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call fcn.100018c00
nop
lea rcx, [rsp + 0x78]
call fcn.100048e40
nop
lea rcx, [rsp + 0x78]
call fcn.1000144b0
mov qword [rsp + 0x50], 0
mov eax, 0x52
jmp 0x100080c0c
cmp dword [rsp + 0x58], 1
jne 0x100080bf6
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, [0x1000125f8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], 0
xor eax, eax
add rsp, 0x98
ret

Function at 0x100080c60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x28], 0xfffffffffffffffe
cmp qword [rsp + 0x40], 0
je 0x100080ca4
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.100018c00
nop
lea rcx, [rsp + 0x20]
call fcn.100048e40
nop
lea rcx, [rsp + 0x20]
call fcn.1000144b0
cmp qword [rsp + 0x48], 0
je 0x100080cbe
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x38
ret
Function at 0x100081820
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
lea rcx, [0x100012868]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x18], 0
jne 0x100081878
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [0x100012830]
mov ecx, 3
call fcn.100053cc0
jmp 0x1000819dc
lea rdx, [0x100012818]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x30], 0
jne 0x1000818b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x1000819dc
lea rdx, [0x100012800]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x20], 0
jne 0x1000818f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x1000819dc
lea rdx, [0x1000127e8]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x28], 0
jne 0x100081935
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x1000819dc
lea rdx, [0x1000127d8]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x38], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x38], 0
jne 0x10008196e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x1000819dc
lea rdx, [0x1000127c0]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x40], 0
jne 0x1000819a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x1000819dc
lea rdx, [0x1000127b8]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x48], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x48], 0
jne 0x1000819dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1000819f4
lea rdx, [0x100012730]
mov ecx, 3
call fcn.100053cc0
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x100083080
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov edx, 0x20019
mov rcx, qword [rsp + 0xa0]
call fcn.10007c600
test eax, eax
jne 0x1000830e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x48], 0
mov rcx, qword [rsp + 0xa8]
call fcn.1000144b0
mov eax, dword [rsp + 0x48]
jmp 0x100083301
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0xa8]
call fcn.100013bb0
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x100083182
cmp dword [rsp + 0x40], 2
je 0x100083164
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x4c], 0
mov rcx, qword [rsp + 0xa8]
call fcn.1000144b0
mov eax, dword [rsp + 0x4c]
jmp 0x100083301
mov dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0xa8]
call fcn.1000144b0
mov eax, dword [rsp + 0x50]
jmp 0x100083301
mov eax, dword [rsp + 0x44]
add rax, 4
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1000831da
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0xa8]
call fcn.1000144b0
mov eax, dword [rsp + 0x60]
jmp 0x100083301
mov eax, dword [rsp + 0x30]
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0xa8]
call fcn.100013bb0
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10008326a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x70], 0
mov rcx, qword [rsp + 0xa8]
call fcn.1000144b0
mov eax, dword [rsp + 0x70]
jmp 0x100083301
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call fcn.100054c80
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xb0]
call fcn.100013ba0
movzx eax, al
test eax, eax
je 0x1000832d2
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x80], 0
mov rcx, qword [rsp + 0xa8]
call fcn.1000144b0
mov eax, dword [rsp + 0x80]
jmp 0x100083301
mov dword [rsp + 0x84], 1
mov rcx, qword [rsp + 0xa8]
call fcn.1000144b0
mov eax, dword [rsp + 0x84]
jmp 0x100083301
add rsp, 0x98
ret