joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020de0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14002101e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x14006b040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x14005a190]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x140020fe6
mov rcx, rbp
call fcn.1400200b0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140020eb1
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140020ea1
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140020e99
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x140020e9c
mov rdx, rcx
test rdx, rdx
jne 0x140020e70
cmp r8, r10
je 0x140020eb1
cmp dword [r8], r9d
jne 0x140020eb1
mov rcx, qword [r8 + 8]
jmp 0x140020eb3
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140020f47
cmp qword [rcx + 0x18], 0
jne 0x140020f3c
mov qword [rcx + 0x18], rbx
jmp 0x140020f47
cmp qword [rcx + 0x20], 0
jne 0x140020f47
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140020f7c
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140020f70
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140005740
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x140020fd8
cmp r9b, 0x23
jne 0x140020fbb
cmp byte [r8], r9b
jne 0x140020fbb
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140020fa8
not ecx
call fcn.14000e200
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x140020e30
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140050500
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14005129c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400512e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400512e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400512e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400512e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400512e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400512e8
xor al, al
add rsp, 0x28
ret
Function at 0x1001112
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x1001135
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x1001160
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x1001159
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x1007674
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
sub rcx, rdx
mov al, byte [rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x100769e
or rdx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, rdx
repne scasb al, byte [rdi]
movzx eax, word [0x0100604c]
mov rcx, rdx
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x01006418]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x10076da
lea rax, [rsp + 0x30]
lea rdx, [0x01006958]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1007730
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov rdx, rbx
call fcn.0100d694
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.0100f170
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x1007da4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x390
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0x380], rax
xor ebx, ebx
mov rbp, rcx
test dl, 0x10
je 0x1007f52
lea rdx, [rsp + 0x270]
mov ebx, 1
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x1007ded
or r14, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x270]
mov rcx, r14
lea r15, [0x010064c0]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r15 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1007e15
xor eax, eax
lea rdi, [rsp + 0x270]
mov rcx, r14
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x010064ec]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1007e3c
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, r14
je 0x1007f43
lea rsi, [rsp + 0x4c]
lea rdi, [0x01006dd0]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x1007f20
lea rsi, [rsp + 0x4c]
lea rdi, [0x01006dd4]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x1007f20
lea rdx, [rsp + 0x160]
mov rcx, rbp
sub rdx, rbp
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x1007ea9
xor eax, eax
lea rdi, [rsp + 0x160]
mov rcx, r14
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r15 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1007ec6
xor eax, eax
lea rdi, [rsp + 0x160]
mov rcx, r14
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1007eeb
lea rcx, [rsp + 0x160]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb ecx, ecx
and ebx, ecx
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1007e69
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x1007f52
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb ecx, ecx
and ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.0100f170
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x1008104
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0x58]
xor ebx, ebx
mov rdi, rcx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
lea rdx, [0x01006a70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10081c4
jmp 0x10081bf
Function at 0x1008b08
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rax, [r11 - 0x28]
lea rcx, [r11 - 0x20]
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
lea ebx, [rbp + 2]
lea r8d, [rbp + 0x20]
mov r9d, 0x220
mov dl, bl
mov dword [rsp + 0x28], ebp
mov byte [rsp + 0x78], bpl
mov byte [rsp + 0x79], bpl
mov dword [rsp + 0x20], ebp
mov byte [rsp + 0x7a], bpl
mov byte [rsp + 0x7b], bpl
mov byte [rsp + 0x7c], bpl
mov byte [rsp + 0x7d], 5
mov qword [r11 - 0x28], rbp
mov qword [r11 - 0x30], rbp
mov dword [rsp + 0x60], ebp
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
lea edx, [rbp + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rsp + 0x60]
call fcn.010123b8
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rsi, rax
lea rax, [rsp + 0x60]
mov edx, ebx
mov r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, ebp
cmp dword [rsi], ebp
jbe 0x1008c1b
lea rbx, [rsi + 8]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, ebp
jne 0x1008c1b
inc edi
add rbx, 0x10
cmp edi, dword [rsi]
jb 0x1008bff
cmp edi, dword [rsi]
mov rcx, rsi
setne bpl
call fcn.0101226c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.0100f170
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1008c70
Capabilities:
Delete registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov ebx, 1
mov rdi, rcx
mov esi, ebx
test rcx, rcx
je 0x1008e29
mov r15, 0xffffffff80000002
and qword [rsp + 0x80], 0
lea rax, [rsp + 0x80]
lea rdx, [rdi + 8]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
xor r12d, r12d
xor r13d, r13d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 5
jne 0x1008d89
and qword [rsp + 0x78], r12
lea rax, [rsp + 0x78]
lea rdx, [rdi + 8]
mov r9d, 0x20000
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x64
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008d54
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0x70]
lea edx, [rax + 4]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov ecx, dword [rsp + 0x70]
call fcn.010123b8
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0x70]
lea edx, [r12 + 4]
mov r8, rax
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov rcx, qword [rsp + 0x78]
test eax, eax
cmove r12, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ebx, [r13 + 1]
lea rcx, [rdi + 8]
mov edx, 0xf003f
call fcn.0100d9a4
test eax, eax
je 0x1008da8
lea rax, [rsp + 0x80]
lea rdx, [rdi + 8]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008da8
mov rcx, qword [rsp + 0x80]
lea rdx, [rdi + 0x2808]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
cmove r13d, ebx
test r12, r12
je 0x1008e07
and qword [rsp + 0x88], 0
lea rax, [rsp + 0x88]
lea rdx, [rdi + 8]
mov r9d, 0x40000
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008dff
mov rcx, qword [rsp + 0x88]
lea edx, [rax + 4]
mov r8, r12
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r12
call fcn.0101226c
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1008e1a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rdi]
and esi, r13d
test rdi, rdi
jne 0x1008c99
mov eax, esi
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100aa2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9d0
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0x9c0], rax
lea r15, [0x01003000]
lea rsi, [rcx + 0x4ac]
xor r14d, r14d
mov rax, qword [r15 + 0x3fc0]
mov rbp, rcx
mov ebx, 1
mov qword [rsi], rax
movzx eax, word [r15 + 0x3fc8]
mov word [rsi + 8], ax
mov rax, qword [rcx]
mov rdx, qword [rax + 0x1b8]
cmp rdx, r14
je 0x100aac2
cmp byte [rdx], r14b
je 0x100aac2
or r12, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rcx, r12
repne scasb al, byte [rdi]
sub rdi, rbx
xor ecx, ecx
mov al, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, rbx
test al, al
jne 0x100aab3
jmp 0x100aae4
xor eax, eax
or r12, 0xffffffffffffffff
mov rdi, rsi
mov rcx, r12
repne scasb al, byte [rdi]
mov eax, dword [0x01006fcc]
sub rdi, rbx
mov dword [rdi], eax
mov al, byte [0x01006fd0]
mov byte [rdi + 4], al
xor eax, eax
mov rdi, rsi
mov rcx, r12
repne scasb al, byte [rdi]
lea r13, [0x010064c0]
sub rdi, rbx
xor ecx, ecx
mov al, byte [r13 + rcx]
mov byte [rdi + rcx], al
add rcx, rbx
test al, al
jne 0x100aafa
mov rdx, qword [rbp]
xor eax, eax
mov rdi, rsi
mov r8, qword [rdx + 0x48]
mov rcx, r12
repne scasb al, byte [rdi]
sub rdi, rbx
xor ecx, ecx
mov al, byte [r8 + rcx]
mov byte [rdi + rcx], al
add rcx, rbx
test al, al
jne 0x100ab20
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
mov ecx, 0x80000002
Function at 0x100c0f4
Capabilities:
Get common file path
Get file attributes
Move file
Persist via run registry key
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x4a0
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0x490], rax
cmp edx, 7
mov rbx, rcx
jl 0x100c158
test rcx, rcx
je 0x100c33c
lea rcx, [rbx + 8]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor edx, edx
lea rcx, [rbx + 8]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x100c12c
jmp 0x100c33c
mov r12d, 0x104
lea rcx, [rsp + 0x50]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x100c1a1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x100c333
lea rcx, [rsp + 0x50]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x100c26e
lea rdx, [0x01007008]
lea rcx, [rsp + 0x380]
mov r8d, esi
call fcn.0101451c
lea rdx, [rsp + 0x160]
lea rcx, [rbx + 8]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea r9, [rsp + 0x160]
lea r8, [rsp + 0x50]
lea rdx, [0x01007018]
lea rcx, [rsp + 0x270]
call fcn.0101451c
lea rdx, [rsp + 0x40]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rdx
lea rdx, [0x01006958]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c32e
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x380]
call fcn.0100d694
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100c32e
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x010064c0]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100c284
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x01006520]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100c2a8
lea rdx, [rsp + 0x160]
lea rcx, [rbx + 8]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov rcx, r12
call fcn.010123b8
mov rdi, rax
test rax, rax
je 0x100c33c
lea rdx, [0x01007038]
mov r8d, esi
mov rcx, rax
call fcn.0101451c
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x160]
lea rcx, [0x01006ffc]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rsp + 0x50]
lea rdx, [0x01006ff8]
lea rcx, [0x01006ffc]
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, rdi
call fcn.0101226c
mov rbx, qword [rbx]
inc esi
test rbx, rbx
jne 0x100c1a8
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.0100f170
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x100d30c
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x850
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbp, qword [rsp + 0x8a0]
and qword [rsp + 0x30], 0
mov r12d, r8d
lea rcx, [rsp + 0x40]
mov r8d, 0x400
mov r13, r9
call fcn.01015070
or rcx, 0xffffffffffffffff
lea rdx, [0x010070a0]
xor eax, eax
mov rdi, rdx
mov byte [rsp + 0x43f], 0
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea r8, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.010141ec
test eax, eax
jne 0x100d3b2
lea rax, [rsp + rdi + 0x40]
cmp byte [rax], 0
je 0x100d3b2
mov rsi, rax
mov r9b, 0x5c
cmp byte [rax], r9b
je 0x100d3f6
inc rdi
lea rax, [rsp + rdi + 0x40]
cmp byte [rax], 0
jne 0x100d3a0
mov edi, 3
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x100d3c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.0100f170
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
mov byte [rsp + rdi + 0x40], 0
lea rdi, [rsp + rdi + 0x41]
cmp byte [rdi], 0
je 0x100d3b2
mov cl, byte [rdi]
xor eax, eax
xor r8d, r8d
test cl, cl
je 0x100d426
mov rdx, rdi
cmp cl, r9b
cmove eax, r8d
inc rdx
inc r8d
mov cl, byte [rdx]
test cl, cl
jne 0x100d413
movsxd rcx, eax
cmp byte [rcx + rdi], r9b
jne 0x100d3b2
inc eax
mov byte [rcx + rdi], 0
lea rdx, [0x010070b0]
movsxd rbx, eax
mov rcx, rsi
add rbx, rdi
call fcn.0101402c
test eax, eax
jne 0x100d457
mov rcx, 0xffffffff80000002
jmp 0x100d475
lea rdx, [0x010070b8]
mov rcx, rsi
call fcn.0101402c
test eax, eax
jne 0x100d3b2
mov rcx, 0xffffffff80000003
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
jne 0x100d3b7
test rbp, rbp
je 0x100d556
mov esi, dword [rsp + 0x8a8]
test esi, esi
je 0x100d556
and dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x440]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x3c], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test eax, eax
jne 0x100d3b7
cmp r12d, dword [rsp + 0x38]
jne 0x100d3b7
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x890], eax
jne 0x100d3b7
lea rdx, [rsp + 0x440]
mov r8, rax
mov rcx, r13
call fcn.01013a50
test eax, eax
jne 0x100d3b7
mov r9d, dword [rsp + 0x898]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
jmp 0x100d3b7
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x100d54f
Function at 0x100d56c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, qword [rdx]
mov rbp, rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x400
xor ebx, ebx
call fcn.01012d10
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rdi
xor esi, esi
mov dword [rsp + 0x40], 0x400
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x100d65e
lea ebx, [rsi + 1]
mov edx, 0x408
mov rcx, rbx
call fcn.01012368
lea rdx, [rsp + 0x50]
mov r11, rax
lea rax, [rsp + 0x50]
mov r8, r11
sub r8, rax
mov cl, byte [rdx]
mov byte [r8 + rdx + 8], cl
add rdx, rbx
test cl, cl
jne 0x100d606
mov rax, qword [rbp]
add esi, ebx
lea r9, [rsp + 0x40]
mov qword [r11], rax
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, esi
mov rcx, rdi
mov qword [rbp], r11
mov dword [rsp + 0x40], 0x400
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x100d5e6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.0100f170
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop rdi
pop rsi
pop rbp
ret

Function at 0x100d694
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r10, rcx
or rcx, 0xffffffffffffffff
mov rdi, r8
xor eax, eax
xor ebx, ebx
repne scasb al, byte [rdi]
lea edi, [rbx + 1]
not rcx
mov r9d, edi
sub rcx, rdi
add ecx, edi
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
cmove ebx, edi
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x100d6ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
lea rax, [r11 + 0x18]
mov rdi, rdx
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], rdx
mov rdx, rcx
mov rcx, qword [rsi]
mov dword [r11 + 0x18], r8d
lea r9, [r11 + 0x20]
xor r8d, r8d
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x100d74e
mov eax, dword [rsp + 0x58]
cmp eax, 1
je 0x100d73e
cmp eax, 2
je 0x100d73e
cmp eax, 7
jne 0x100d74e
mov eax, dword [rsp + 0x50]
dec eax
mov byte [rax + rdi], bl
mov ebx, 1
jmp 0x100d750
mov byte [rdi], bl
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret