joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004c4e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x20
lea r14d, [rdx + 4]
mov rsi, r9
mov r12, r8
mov ebp, edx
mov rdi, rcx
cmp edx, r14d
jae 0x18004c5d5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r15
mov r15, qword [rsp + 0x60]
nop word [rax + rax]
mov eax, ebp
sub eax, 0xc
je 0x18004c574
sub eax, 4
je 0x18004c55f
sub eax, 1
je 0x18004c550
cmp eax, 3
jne 0x18004c5b6
movzx eax, byte [rdi]
mov byte [rsi], al
mov eax, dword [rdi]
sar eax, 8
mov byte [rsi + 1], al
movzx eax, byte [rdi + 2]
mov byte [rsi + 2], al
jmp 0x18004c5b6
mov eax, dword [r15]
add dword [rdi + 4], eax
mov eax, dword [r12]
add dword [rdi + 8], eax
jmp 0x18004c5b6
mov eax, dword [rsi]
test al, 1
je 0x18004c56a
mov byte [rdi], 1
mov eax, dword [rsi]
test al, 2
je 0x18004c5b6
mov byte [rdi + 1], 1
jmp 0x18004c5b6
mov rbx, rsi
test rsi, rsi
je 0x18004c5b6
nop dword [rax]
mov rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x18004c5c3
mov edx, dword [rbx + 0x18]
lea r8d, [rax + 1]
mov rcx, qword [rbx]
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
jne 0x18004c5c3
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18004c580
inc ebp
cmp ebp, r14d
jb 0x18004c520
jmp 0x18004c5cb
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rdi
ret
Function at 0x18004da00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movzx ebx, byte [rsp + 0x90]
mov r12d, r8d
imul r13d, r8d, 0x235
mov r14, rcx
mov r15d, r8d
cmp r8d, r13d
ja 0x18004da7a
mov rsi, qword [rsp + 0x98]
xor ecx, ecx
movzx edi, byte [rsp + 0x90]
nop dword [rax + rax]
mov eax, r15d
sub eax, 0x90
je 0x18004dafa
sub eax, 0x10
je 0x18004daac
sub eax, 0x20
je 0x18004da9c
sub eax, 0x4680
je 0x18004da95
cmp eax, 0x46a0
jne 0x18004dc20
movzx eax, bl
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov bl, 1
jmp 0x18004dc20
mov qword [r14], rdx
mov qword [r14 + 8], 0
jmp 0x18004dc20
mov qword [rsp + 0x28], rcx
lea r8, [0x18001ea30]
mov dword [rsp + 0x20], ecx
mov r9, r14
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
test rax, rax
je 0x18004dc35
lea r8, [rsp + 0x90]
mov dword [rsp + 0x90], 1
mov edx, 0x86
mov rcx, r14
call fcn.1800313b0
jmp 0x18004dc16
cmp byte [r14], 0
je 0x18004dc20
mov ebp, 0xe9
nop dword [rax]
cmp ebp, 0xe9
je 0x18004dbdc
cmp ebp, 0x4c74
je 0x18004dbc1
cmp ebp, 0x97ff
je 0x18004db9e
cmp ebp, 0xe38a
jne 0x18004dbfa
mov r14, rsi
test dil, dil
je 0x18004db92
mov ecx, 0x9b
nop dword [rax]
mov eax, ecx
sub eax, 0x99
je 0x18004db6d
sub eax, 1
je 0x18004db68
cmp eax, 1
jne 0x18004db86
mov byte [rsi], dil
jmp 0x18004db86
inc r14
jmp 0x18004db86
mov eax, dword [0x180096fd4]
mov dword [0x180096fcc], eax
mov eax, dword [rsp + 0x98]
add dword [0x180096fd0], eax
dec ecx
cmp ecx, 0x98
ja 0x18004db50
jmp 0x18004dbfa
mov eax, dword [rsp + 0x30]
add dword [0x180096fcc], eax
jmp 0x18004dbfa
mov eax, dword [0x180096fcc]
mov rcx, r14
mov dword [0x18006f534], eax
mov eax, dword [0x180096fd0]
mov dword [0x18006f538], eax
call qword [0x180071d20]
jmp 0x18004dbfa
lea r8, [rsp + 0x98]
mov byte [rsi], 0
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [0x180070b28]
jmp 0x18004dbfa
movzx edi, byte [r14]
mov rsi, r14
test dil, dil
je 0x18004dbfa
cmp dil, 0xa
je 0x18004dbfa
movzx edi, byte [rsi + 1]
inc rsi
test dil, dil
jne 0x18004dbe8
add ebp, 0x4b8b
cmp ebp, 0x12e2c
jbe 0x18004db10
cmp byte [r14], 0
jne 0x18004db04
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
imul eax, r12d, 0x71
add r15d, eax
cmp r15d, r13d
jbe 0x18004da50
jmp 0x18004da7a
jmp 0x18004da7d
Function at 0x18005a9b0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea r15d, [rcx - 7]
mov rbx, r8
mov ebp, ecx
cmp ecx, r15d
jbe case.0x18005aa08.0
mov r13d, dword [rsp + 0x60]
lea r14d, [rcx - 0xd2]
mov r12d, dword [rsp + 0x60]
lea r8, [0x180000000]
cmp r14d, 0x10
ja case.0x18005aa08.3
mov ecx, dword [r8 + r14*4 + 0x5abe4]
add rcx, r8
jmp rcx
lea eax, [r12 + 5]
movsxd r11, r13d
movsxd r9, eax
lea eax, [r13 + 5]
movsxd rsi, eax
cmp r11, rsi
jge case.0x18005aa08.3
mov rax, r11
movsxd rdi, r12d
shl rax, 6
add rax, rdi
lea r10, [rax*8 + 0x839e0]
add r10, r8
nop dword [rax]
mov r8, rdi
cmp rdi, r9
jge 0x18005aa8f
mov rdx, r10
nop dword [rax + rax]
mov rcx, qword [rdx]
cmp rcx, 0x25
jbe 0x18005aa83
cmp byte [rcx + 0x18], 0
je 0x18005aa83
mov eax, dword [rcx + 0x50]
cmp dword [rbx + 0x4c], eax
jg 0x18005aa83
mov eax, dword [rcx + 0x4c]
cmp dword [rbx + 0x50], eax
jl 0x18005aa83
mov eax, dword [rcx + 0x58]
cmp dword [rbx + 0x54], eax
jg 0x18005aa83
mov eax, dword [rcx + 0x54]
cmp dword [rbx + 0x58], eax
jge 0x18005aba9
inc r8
add rdx, 8
cmp r8, r9
jl 0x18005aa50
inc r11
add r10, 0x200
cmp r11, rsi
jl 0x18005aa40
jmp 0x18005ab8d
mov r9d, 0x109
mov r8, rbx
xor edx, edx
xor ecx, ecx
call fcn.180045d90
movsx r13d, word [rbx + 0x26]
movsx r12d, word [rbx + 0x2a]
sub r13d, 2
sub r12d, 2
jmp 0x18005ab8d
mov edx, 4
lea rcx, [rsp + 0x78]
mov r9, rbx
lea r8d, [rdx - 3]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x18005abb0
movzx eax, byte [rsp + 0x7a]
movzx ecx, byte [rsp + 0x7b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x79]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x78]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x60], ecx
jmp 0x18005ab8d
mov rax, rbx
mov r8d, 0xff
nop
mov edx, 0x78
cmp edx, 0x78
je 0x18005ab4f
cmp edx, 0x36d8
jne 0x18005ab64
mov ecx, dword [rax + 4]
cmp ecx, 0x100
jb 0x18005ab49
add ecx, 0xffffff00
lea ecx, [rbx + rcx*8]
mov dword [rax + 4], ecx
add rax, 8
jmp 0x18005ab64
mov ecx, dword [rax]
cmp ecx, 0x100
jb 0x18005ab64
add ecx, 0xffffff00
lea ecx, [rbx + rcx*8]
mov dword [rax], ecx
add edx, 0x3660
cmp edx, 0x6cc0
jbe 0x18005ab25
sub r8, 1
jne 0x18005ab20
jmp 0x18005ab8d
mov rdx, qword [rdx]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x18005abb0
mov rdx, qword [rsp + 0x68]
lea r8, [0x180000000]
dec ebp
dec r14d
cmp ebp, r15d
ja 0x18005a9f3
jmp case.0x18005aa08.0
mov byte [rsp + 0x60], 1
jmp case.0x18005aa08.0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [rsp + 0x60], 0
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a340
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
lea rcx, [rsp + 0x70]
call sym.Prounstl.exe_public:_void___cdecl_CNcsRegKey::constructor_void____ptr64
nop
cmp byte [rsi + 0x10], 0
je 0x14000a4e4
test rbx, rbx
je 0x14000a4e4
mov rdx, qword [rdi]
mov rcx, rbx
call fcn.14001ac44
test rax, rax
je 0x14000a4e4
mov rdx, rbx
lea rcx, [rsp + 0x48]
call sym.Prounstl.exe_public:_void___cdecl_CNcsString::constructor_wchar_t_const____ptr64____ptr64
nop
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x70]
call sym.Prounstl.exe_public:_bool___cdecl_CNcsRegKey::Open_struct_HKEY______ptr64__class_CNcsString_const____ptr64__bool____ptr64
movzx edi, al
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000a420
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a41b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a515
call fcn.14001557c
test dil, dil
je 0x14000a4e4
mov dword [rbp - 0x50], 0x100
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000a4c8
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x40], 0x100
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call sym.Prounstl.exe_public:_bool___cdecl_CNcsRegKey::DeleteSubKey_wchar_t_const____ptr64__unsigned_long_long_unsigned___int64__const____ptr64____ptr64
test al, al
je 0x14000a4e4
mov dword [rbp - 0x50], 0x100
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000a470
lea rcx, [rsp + 0x70]
call sym.Prounstl.exe_public:_void___cdecl_CNcsRegKey::Close_void____ptr64
mov rdx, rbx
mov rcx, rsi
call sym.Prounstl.exe_private:_unsigned_long_int___cdecl_CNcsRegKey::RemoveSubKey_wchar_t_const____ptr64____ptr64
test eax, eax
sete bl
jmp 0x14000a4e6
xor bl, bl
lea rcx, [rsp + 0x70]
call sym.Prounstl.exe_public_virtual:_void___cdecl_CNcsRegKey::destructor_void____ptr64
movzx eax, bl
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140015690
mov rbx, qword [rsp + 0x308]
add rsp, 0x2d0
pop rdi
pop rsi
pop rbp
ret
call fcn.14001a7fc
nop
int3
Function at 0x14000a520
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x10], 0
mov rbx, rcx
mov dword [rcx + 0x14], 0
je 0x14000a54d
cmp qword [rdx + 0x18], 8
jb 0x14000a540
mov rdx, qword [rdx]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rbx + 0x14], eax
cmp dword [rbx + 0x14], 0
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x14000a560
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rdx
mov rbx, rcx
xor dil, dil
mov dword [rsp + 0x60], 0x100
cmp byte [rcx + 0x10], dil
je 0x14000a669
mov edx, dword [rcx + 0x18]
lea eax, [rdx + 1]
mov dword [rcx + 0x18], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rbx + 0x14], eax
cmp eax, 0x103
jne 0x14000a5e9
mov dword [rbx + 0x18], edi
jmp 0x14000a669
test eax, eax
sete dil
test eax, eax
jne 0x14000a669
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call sym.Prounstl.exe_public:_void___cdecl_CNcsString::constructor_wchar_t_const____ptr64____ptr64
nop
cmp qword [rax + 0x18], 8
jb 0x14000a60d
mov rax, qword [rax]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000a614
mov rdx, rax
mov rcx, rsi
call sym.Prounstl.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000a669
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a664
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a692
call fcn.14001557c
movzx eax, dil
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140015690
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14001a7fc
int3
Function at 0x14000a6a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x460
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x450], rax
cmp byte [rcx + 0x10], 0
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x40], 0x200
je 0x14000a77c
mov edx, dword [rcx + 0x18]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x480], rsi
lea r8, [rsp + 0x50]
xor esi, esi
mov qword [rsp + 0x38], rsi
lea eax, [rdx + 1]
mov qword [rsp + 0x30], rsi
mov dword [rcx + 0x18], eax
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rbx + 0x14], eax
cmp eax, 0x103
jne 0x14000a74a
mov dword [rbx + 0x18], esi
xor al, al
mov rsi, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140015690
mov rbx, qword [rsp + 0x488]
add rsp, 0x460
pop rdi
ret
test eax, eax
sete bl
test eax, eax
jne 0x14000a777
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], si
jne 0x14000a760
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sym.Prounstl.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
movzx eax, bl
jmp 0x14000a721
xor al, al
jmp 0x14000a729

Function at 0x14000a820
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x30], eax
mov dword [rcx + 0x14], eax
cmp byte [rcx + 0x10], al
je 0x14000a873
cmp qword [rdx + 0x18], 8
jb 0x14000a850
mov rdx, qword [rdx]
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbx + 0x14], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140015690
add rsp, 0x40
pop rbx
ret
Function at 0x14000a890
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov byte [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x30]
lea rdx, str.CNcsRegKey::GetValue
lea rcx, [rsp + 0x40]
call fcn.140008870
nop
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x38], 4
cmp byte [rdi + 0x10], 0
je 0x14000a97e
lea rdx, str.CNcsRegKey::GetValue_m_bIsOpened__true
lea rcx, [0x140048c60]
call fcn.140008e30
cmp qword [rbx + 0x18], 8
jb 0x14000a918
mov rbx, qword [rbx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rdi + 0x14], eax
test eax, eax
sete byte [rsp + 0x30]
mov r8d, eax
lea rdx, str.CNcsRegKey::GetValue_:_d
lea rcx, [0x140048c60]
call fcn.140008e30
cmp dword [rsp + 0x34], 4
je 0x14000a97e
lea rdx, str.CNcsRegKey::GetValue_dwRegType___REG_DWORD
lea rcx, [0x140048c60]
call fcn.140008e30
xor bl, bl
mov byte [rsp + 0x30], bl
jmp 0x14000a983
movzx ebx, byte [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140008960
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140015690
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000a9b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x480
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov byte [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x30]
lea rdx, str.CNcsRegKey::GetValue
lea rcx, [rsp + 0x40]
call fcn.140008870
nop
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x34], 0x200
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x70]
call fcn.140017670
xor ecx, ecx
mov qword [rdi + 0x10], rcx
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000aa39
mov rax, qword [rdi]
mov word [rax], cx
cmp byte [rsi + 0x10], cl
je 0x14000aaa8
cmp qword [rbx + 0x18], 8
jb 0x14000aa4b
mov rbx, qword [rbx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsi + 0x14], eax
test eax, eax
sete byte [rsp + 0x30]
test eax, eax
jne 0x14000aaa8
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14000aa90
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sym.Prounstl.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
movzx ebx, byte [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140008960
movzx eax, bl
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140015690
add rsp, 0x480
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000ad20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 0x10], 0
mov rbx, rcx
mov dword [rsp + 0x30], 3
je 0x14000ad87
cmp qword [rdx + 0x18], 8
jb 0x14000ad50
mov rdx, qword [rdx]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [rbx + 0x14], eax
sete al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140015690
add rsp, 0x40
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140015690
add rsp, 0x40
pop rbx
ret

Function at 0x14000be60
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
movzx r9d, r9b
mov rbx, rcx
inc r9d
mov dword [rcx + 0x14], 0
cmp byte [rcx + 0x10], 0
mov eax, dword [r8 + 0x10]
je 0x14000bec0
cmp qword [r8 + 0x18], 8
jb 0x14000be8b
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x14000be95
mov rdx, qword [rdx]
mov rcx, qword [rcx + 8]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [rbx + 0x14], eax
sete al
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x14000bed0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 0x10], 0
mov rbx, rcx
mov dword [rsp + 0x30], r8d
je 0x14000bf3d
cmp qword [rdx + 0x18], 8
jb 0x14000befd
mov rdx, qword [rdx]
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [rbx + 0x14], eax
sete al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140015690
add rsp, 0x40
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140015690
add rsp, 0x40
pop rbx
ret

Function at 0x14000bf60
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 0x10], 0
mov rbx, rcx
mov dword [rcx + 0x14], 0
je 0x14000bfab
cmp qword [rdx + 0x18], 8
jb 0x14000bf80
mov rdx, qword [rdx]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [rbx + 0x14], eax
sete al
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x14000bfc0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r8
mov r15, rdx
mov r13, rcx
mov qword [rsp + 0x30], r8
xor r14d, r14d
mov dword [rcx + 0x14], r14d
cmp byte [rcx + 0x10], r14b
je 0x14000c06a
mov ebx, r14d
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
sub rcx, rdx
sar rcx, 5
test rcx, rcx
je 0x14000c035
add rdx, 0x10
nop dword [rax + rax]
mov rax, qword [rdx]
lea rbx, [rbx + rax*2]
add rbx, 2
lea rdx, [rdx + 0x20]
sub rcx, 1
jne 0x14000c020
add rbx, 2
mov rcx, rbx
call fcn.14001debc
mov rbp, rax
test rax, rax
jne 0x14000c079
lea r9, str.ERROR:__Unable_to_allocate_memory
mov r8d, 0x2b6
lea rdx, str.C:Sandbox1094746CommonSrcNcsRegKey.cpp
lea rcx, [0x140048c60]
call fcn.140008d40
nop
mov rcx, rdi
call fcn.14000c2b0
xor al, al
jmp 0x14000c148
mov r8, rbx
xor edx, edx
mov rcx, rbp
call fcn.140017670
mov r12, rbp
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x14000c0f8
mov rsi, r14
nop
lea r9, [rsi + rcx]
mov rax, r9
cmp qword [r9 + 0x18], 8
jb 0x14000c0b1
mov rax, qword [r9]
mov r9, qword [r9 + 0x10]
inc r9
mov qword [rsp + 0x20], rax
mov r8, r12
mov edx, 0x2c4
lea rcx, str.C:Sandbox1094746CommonSrcNcsRegKey.cpp
call fcn.14000c460
mov rcx, qword [rdi]
mov rax, qword [rsi + rcx + 0x10]
lea r12, [r12 + rax*2]
add r12, 2
inc r14
add rsi, 0x20
mov rax, qword [rdi + 8]
sub rax, rcx
sar rax, 5
cmp r14, rax
jb 0x14000c0a0
mov byte [rbx + rbp - 1], 0
cmp qword [r15 + 0x18], 8
jb 0x14000c107
mov r15, qword [r15]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
mov r9d, 7
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r13 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [r13 + 0x14], eax
mov rcx, rbp
call fcn.14001a980
nop
mov rcx, rdi
cmp dword [r13 + 0x14], 0
jne 0x14000c06d
call fcn.14000c2b0
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140015690
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c1f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
mov byte [rsp + 0x30], 0
mov rbx, rdx
lea r8, [rsp + 0x30]
mov rdi, rcx
lea rdx, str.CNcsRegKey::ValueExists
lea rcx, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call fcn.140008870
cmp byte [rdi + 0x10], 0
je 0x14000c280
cmp qword [rbx + 0x18], 8
jb 0x14000c24c
mov rbx, qword [rbx]
mov rcx, qword [rdi + 8]
xor eax, eax
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, byte [rsp + 0x30]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov byte [rsp + 0x30], bl
jmp 0x14000c285
movzx ebx, byte [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140008960
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140015690
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret