joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140128500
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x110
movaps xmmword [r11 - 0x18], xmm6
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov rbx, r8
mov rax, rdx
mov dword [r11 - 0x28], r9d
mov dword [rsp + 0x30], 0
lea rcx, str.Py__
mov qword [rsp + 0x38], rcx
movaps xmm6, xmmword [rsp + 0x30]
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x140128552
mov rdx, qword [r8]
mov dword [rsp + 0x28], 4
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x20], rcx
mov r9d, 4
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140128592
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xd
lea rdx, str.SetDwordValue
lea rcx, [rsp + 0x40]
call fcn.140010ea0
nop
movd eax, xmm6
test eax, eax
jne 0x140128632
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14012860b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140128606
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012862c
call fcn.1401853a0
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.140185380
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
ret
call fcn.1401b3c00
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14000fc10
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1401577f0
mov rbx, rax
lea r8, [0x14024ddac]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.140062490
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.14002f410
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140027ce0
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1401297c0
int3
Function at 0x140128870
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x110
movaps xmmword [r11 - 0x18], xmm6
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, r8
mov rax, rdx
mov qword [r11 - 0x38], r9
mov dword [rsp + 0x30], 0
lea rcx, str.Py__
mov qword [rsp + 0x38], rcx
movaps xmm6, xmmword [rsp + 0x30]
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x1401288c2
mov rdx, qword [r8]
mov dword [rsp + 0x28], 8
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x20], rcx
mov r9d, 0xb
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140128902
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xd
lea rdx, str.SetQwordValue
lea rcx, [rsp + 0x40]
call fcn.140010ea0
nop
movd eax, xmm6
test eax, eax
jne 0x1401289a2
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14012897b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140128976
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012899c
call fcn.1401853a0
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140185380
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
ret
call fcn.1401b3c00
nop
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call fcn.14000fc10
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1401577f0
mov rbx, rax
lea r8, [0x14024ddac]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140062490
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14002f410
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.140027ce0
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1401297c0
int3
Function at 0x14012a2b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp 0x14012a2b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x100
movaps xmmword [rsp + 0xf0], xmm6
mov rbx, rdx
xor esi, esi
mov dword [rsp + 0x30], esi
lea rax, str.Py__
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
cmp qword [rdx + 0x18], 8
jb 0x14012a2ee
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14012a32a
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x14012a325
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
xor dil, dil
jmp 0x14012a32d
mov dil, 1
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xb
lea rdx, str.ValueExists
lea rcx, [rsp + 0x40]
call fcn.140010ea0
nop
movd eax, xmm6
test eax, eax
jne 0x14012a3c2
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14012a39e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012a399
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012a3bc
call fcn.1401853a0
movzx eax, dil
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret
call fcn.1401b3c00
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14000fc10
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1401577f0
mov rbx, rax
lea r8, [0x14024ddac]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.140062490
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.14002f410
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140027ce0
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1401297c0
int3
Function at 0x14012a620
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rax, str.Py__
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r8
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x44], 4
movups xmmword [r8], xmm0
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x40], 0
jb 0x14012a677
mov rdx, qword [rdx]
lea rax, [rsp + 0x44]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14012a6ca
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140185380
add rsp, 0x60
pop rbx
ret
cmp dword [rsp + 0x40], 4
je 0x14012a6db
mov dword [rsp + 0x30], 0x65d
jmp 0x14012a6a1
cmp dword [rsp + 0x44], 4
je 0x14012a6f1
mov edx, 1
mov rcx, rbx
call fcn.14012f750
jmp 0x14012a6b5
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140185380
add rsp, 0x60
pop rbx
ret

Function at 0x14012a8b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0
lea rax, str.Py__
mov qword [rsp + 0x40], rax
mov rbx, r8
movups xmm0, xmmword [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x34], 8
movups xmmword [r8], xmm0
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x30], 0
jb 0x14012a908
mov rdx, qword [rdx]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14012a95b
mov dword [rsp + 0x38], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx], xmm0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140185380
add rsp, 0x50
pop rbx
ret
cmp dword [rsp + 0x30], 0xb
je 0x14012a96c
mov dword [rsp + 0x38], 0x65d
jmp 0x14012a932
cmp dword [rsp + 0x34], 8
je 0x14012a982
mov edx, 1
mov rcx, rbx
call fcn.14012f750
jmp 0x14012a946
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140185380
add rsp, 0x50
pop rbx
ret
Function at 0x14012b090
Capabilities:
Set registry value

Disassembly:
mov r10, r8
mov rcx, rdx
mov rdx, r10
mov r8, r9
jmp 0x14012b090
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 8], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov rdx, r8
lea rcx, [rbp - 0x10]
call fcn.14012e300
nop
mov dword [rsp + 0x30], 0
lea rax, str.Py__
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov rcx, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
sub rcx, r8
mov eax, ecx
cmp rax, rcx
jne 0x14012b22c
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14012b115
mov rdx, qword [rdi]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r8
mov r9d, 7
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14012b149
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14012b183
mov rdx, qword [rbp]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b17e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012b257
call fcn.1401853a0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov r8d, 0x1e
lea rdx, str.SetMultistringFilterEmptyValue
lea rcx, [rsp + 0x50]
call fcn.140010ea0
nop
movd eax, xmm6
test eax, eax
jne 0x14012b25d
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14012b200
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b1fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012b226
call fcn.1401853a0
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140185380
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call fcn.1401b3c00
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.1400642c0
lea rdx, [0x14028fe68]
lea rcx, [rsp + 0x30]
call fcn.1401a8f20
nop
call fcn.1401b3c00
nop
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.14000fc10
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1401577f0
mov rbx, rax
lea r8, [0x14024ddac]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.140062490
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14002f410
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140027ce0
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1401297c0
int3
Function at 0x14012b530
Capabilities:
Set registry value

Disassembly:
mov r10, r8
mov rcx, rdx
mov rdx, r10
mov r8, r9
jmp 0x14012b530
push rbx
sub rsp, 0x110
movaps xmmword [rsp + 0x100], xmm6
mov rbx, rdx
mov dword [rsp + 0x30], 0
lea rax, str.Py__
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov r10, qword [r8]
mov r9, qword [r8 + 8]
sub r9, r10
mov eax, r9d
cmp rax, r9
jne 0x14012b63f
cmp qword [rdx + 0x18], 8
jb 0x14012b57d
mov rdx, qword [rdx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r10
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14012b5af
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xe
lea rdx, str.SetBinaryValue
lea rcx, [rsp + 0x40]
call fcn.140010ea0
nop
movd eax, xmm6
test eax, eax
jne 0x14012b66a
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14012b628
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012b623
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012b639
call fcn.1401853a0
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
ret
call fcn.1401b3c00
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x60]
call fcn.1400642c0
lea rdx, [0x14028fe68]
lea rcx, [rsp + 0x60]
call fcn.1401a8f20
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14000fc10
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.1401577f0
mov rbx, rax
lea r8, [0x14024ddac]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x98]
call fcn.140062490
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.14002f410
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.140027ce0
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1401297c0
int3

Function at 0x14012d430
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [rcx + 0x58]
lea r15, [rcx + 0x60]
mov qword [rsp + 0x88], rsi
mov r13, r9
mov qword [rsp + 0x40], rdi
mov r14, r8
mov rbx, rdx
mov rbp, rcx
cmp qword [r14 + 0x18], 8
mov rdx, r14
jb 0x14012d46d
mov rdx, qword [r14]
mov qword [rsp + 0x28], r15
lea r9, [rbp + 0x64]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14012d4c7
cmp eax, 0xea
jne 0x14012d4ad
mov esi, dword [rbp + 0x60]
lea rcx, [rbp + 0x40]
mov edx, esi
call fcn.14005ded0
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x60], esi
jmp 0x14012d460
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r13], xmm0
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x14012d9c0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
mov dword [rsp + 0x20], 0
lea r8, str.Py__
mov eax, r9d
mov qword [rsp + 0x28], r8
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
cmp qword [rdx + 0x18], 8
jb 0x14012d9f2
mov rdx, qword [rdx]
xor r9d, r9d
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
je 0x14012da2a
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x14012da22
mov dword [rsp + 0x20], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
xor al, al
add rsp, 0x30
pop rbx
ret
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14012da40
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, r9d
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, str.Py__
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r8], xmm0
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
cmp qword [rdx + 0x18], 8
jb 0x14012daa8
mov rdx, qword [rdx]
xor r9d, r9d
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea rdx, [0x1402984b8]
test eax, eax
je 0x14012dadf
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x14012dadb
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rdx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
xor al, al
jmp 0x14012dae1
mov al, 1
cmp dword [rsp + 0x30], ebx
je 0x14012dc1b
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
mov r9d, 0x3001f
mov r8, r13
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14012d900
nop
mov rbx, qword [rsp + 0x30]
cmp dword [r12], 0
je 0x14012db24
xor sil, sil
jmp 0x14012dc09
test rbx, rbx
jne 0x14012db31
mov sil, 1
jmp 0x14012dc09
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14012d5e0
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
cmp dword [r12], 0
jne 0x14012dbb2
mov r14, r15
cmp r15, rbp
je 0x14012dc40
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14012db7a
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x14012db8f
lea ecx, [rax - 2]
cmp ecx, 1
ja 0x14012db98
add r14, 0x20
cmp r14, rbp
jmp 0x14012db67
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r12], xmm0
xor sil, sil
test r15, r15
je 0x14012dc09
mov rdi, r15
cmp r15, rbp
je 0x14012dbd3
mov rcx, rdi
call fcn.140010b20
add rdi, 0x20
cmp rdi, rbp
jne 0x14012dbc2
mov rdx, qword [rsp + 0x50]
sub rdx, r15
and rdx, 0xffffffffffffffe0
mov rax, r15
cmp rdx, 0x1000
jb 0x14012dc00
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012dc59
mov rcx, r15
call fcn.1401853a0
nop
test rbx, rbx
je 0x14012dc17
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rsi
call fcn.14012d9c0
mov sil, 1
jmp 0x14012dbb5
call fcn.1401b3c00
int3
Function at 0x14012df70
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x38], rcx
xor r12d, r12d
mov dword [rbp - 0x38], r12d
lea rax, str.Py__
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r8], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
movzx ebx, byte [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
inc rcx
call fcn.140102f30
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8d, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, eax
test eax, eax
je 0x14012e0ba
lea edi, [rdx - 1]
mov r8, qword [rbp - 0x18]
lea rcx, [r8 + 1]
cmp rdx, rcx
jbe 0x14012e097
cmp rdi, r8
ja 0x14012e032
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rdi
mov word [rax + rdi*2], r12w
jmp 0x14012dfd0
mov rdx, rdi
sub rdx, r8
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x14012e079
mov qword [rbp - 0x18], rdi
lea r9, [rbp - 0x28]
cmp rcx, 8
cmovae r9, qword [rbp - 0x28]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14012e06b
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x14012dfd0
lfence
mov word [rsp + 0x20], r12w
mov r9, rdx
movzx r8d, bl
lea rcx, [rbp - 0x28]
call fcn.140012e90
jmp 0x14012dfd0
lfence
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14000fb30
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
jmp 0x14012e125
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x38], eax
lea rax, [0x1402984b8]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r15], xmm0
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14012e125
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012e120
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012e143
call fcn.1401853a0
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140185380
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401b3c00
int3
Function at 0x14012e150
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [rsp + 0x80]
lea rax, str.Py__
mov qword [rsp + 0x38], rax
mov r11d, r8d
mov dword [rsp + 0x30], 0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov r10, qword [r9]
mov r8, qword [r9 + 8]
sub r8, r10
mov eax, r8d
cmp rax, r8
jne 0x14012e1d1
cmp qword [rdx + 0x18], 8
jb 0x14012e199
mov rdx, qword [rdx]
mov dword [rsp + 0x28], r8d
mov r9d, r11d
xor r8d, r8d
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14012e1cb
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.1400642c0
lea rdx, [0x14028fe68]
lea rcx, [rsp + 0x30]
call fcn.1401a8f20
int3

Function at 0x14012e420
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
movzx eax, byte [r8 + 0x20]
cmp al, 1
jne 0x14012e456
mov r8d, dword [r8]
call fcn.14012ea40
jmp 0x14012e58a
cmp al, 2
jne 0x14012e464
call fcn.14012eb40
jmp 0x14012e58a
cmp al, 3
jne 0x14012e4e6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rdx, r8
lea rcx, [rsp + 0x30]
call fcn.14012e300
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov r8d, 7
mov rdx, rdi
mov rcx, rbx
call fcn.14012e150
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14012e58a
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012e4dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012e59f
call fcn.1401853a0
jmp 0x14012e58a
cmp al, 4
jne 0x14012e502
mov qword [rsp + 0x20], rsi
mov r9, r8
mov r8d, 3
call fcn.14012e150
jmp 0x14012e58a
cmp al, 5
jne 0x14012e510
mov r8, qword [r8]
call fcn.14012eac0
jmp 0x14012e58a
cmp al, 6
jne 0x14012e51b
call fcn.14012ec20
jmp 0x14012e58a
test al, al
jne 0x14012e57d
xor ecx, ecx
mov dword [rsp + 0x30], ecx
lea rax, str.Py__
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x14012e544
mov rdi, qword [rdx]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14012e58a
mov dword [rsp + 0x30], eax
lea rax, [0x1402984b8]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
jmp 0x14012e58a
mov edx, 2
mov rcx, rsi
call fcn.14012f750
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140185380
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call fcn.1401b3c00
int3