joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c0e0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x558
mov r15d, r8d
mov r14, rdx
mov rdx, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov qword [rsp + 0x20], r14
xor ebp, ebp
lea rsi, [rsp + 0x290]
mov rcx, rsi
xor r8d, r8d
mov r9d, 3
call fcn.140084d40
lea rdi, [rsp + 0x28]
mov rcx, rsi
mov rdx, rdi
call fcn.140084e70
movzx eax, byte [rsp + 0x3f]
test al, al
jns 0x14007c14c
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14007c282
lea rsi, [rsp + 0x290]
lea rbx, [rsp + 0x40]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13d, r13d
jmp 0x14007c17c
mov r13d, ebp
test rax, rax
je 0x14007c282
mov rcx, rsi
mov rdx, rbx
call fcn.140084de0
mov edx, dword [rsp + 0x40]
test dl, 1
je 0x14007c1bd
test r15b, r15b
jne 0x14007c1a5
mov rcx, rbx
call fcn.140084b10
test al, al
jne 0x14007c1bd
mov edx, dword [rsp + 0x40]
and edx, 0xfffffffe
cmp byte [rsp + 0x3f], 0
mov rcx, rdi
jns 0x14007c1b7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.140084b10
test al, al
je 0x14007c210
xor ebp, ebp
test r15b, r15b
je 0x14007c23e
mov rcx, rdi
mov rdx, r14
mov r8b, 1
call fcn.14007c0e0
mov ebp, eax
test eax, eax
jne 0x14007c23e
cmp byte [rsp + 0x3f], 0
mov rcx, rdi
jns 0x14007c1f3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x14007c23e
jmp 0x14007c228
cmp byte [rsp + 0x3f], 0
mov rcx, rdi
jns 0x14007c21f
mov rcx, qword [rsp + 0x28]
call r12
xor ebp, ebp
test eax, eax
jne 0x14007c23e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
or eax, 1
cmp eax, 3
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, rbx
call fcn.140015bf0
mov rcx, rsi
mov rdx, rbx
call fcn.140084e70
mov rcx, rdi
mov rdx, rbx
call fcn.14005bad0
mov rcx, rbx
call fcn.14005baa0
movzx eax, byte [rsp + 0x3f]
test al, al
jns 0x14007c170
mov rax, qword [rsp + 0x30]
jmp 0x14007c170
lea rcx, [rsp + 0x28]
call fcn.14005baa0
lea rcx, [rsp + 0x290]
call fcn.140084d70
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, ebp
add rsp, 0x558
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007c490
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov esi, r9d
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rdx, str.Read
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x3d
call fcn.140060640
lea rcx, [rsp + 0x60]
mov rdx, rbx
xor r8d, r8d
call fcn.14006fcd0
test esi, esi
js 0x14007c557
lea rcx, [rsp + 0x30]
call fcn.14007eed0
call fcn.1400bc040
test al, al
je 0x14007c518
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1400bc0e0
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], eax
mov rcx, qword [r15]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007c55e
mov esi, dword [rsp + 0x2c]
jmp 0x14007c56f
mov esi, 0xffffffff
jmp 0x14007c579
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x30]
call fcn.1400bc0b0
lea rcx, [rsp + 0x60]
call fcn.14006fe00
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14007c5b0
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdx, str.ReadAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r9d, 0x56
call fcn.140060640
lea rcx, [rsp + 0x58]
mov rdx, rdi
xor r8d, r8d
call fcn.14006fcd0
test esi, esi
js 0x14007c657
lea rcx, [rsp + 0x38]
call fcn.14007eed0
call fcn.1400bc040
test al, al
je 0x14007c630
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x38]
mov r8, rbx
call fcn.1400bc0e0
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007c65e
mov esi, dword [rsp + 0x34]
jmp 0x14007c66f
mov esi, 0xffffffff
jmp 0x14007c679
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x38]
call fcn.1400bc0b0
lea rcx, [rsp + 0x58]
call fcn.14006fe00
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007c6a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rdx, str.Write
lea r8, str..._.._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x72
call fcn.140060640
lea rcx, [rsp + 0x68]
xor esi, esi
mov rdx, r15
xor r8d, r8d
call fcn.14006fcd0
lea rcx, [rsp + 0x30]
call fcn.14007eed0
call fcn.1400bc040
test al, al
je 0x14007c72a
movsxd r9, ebp
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400bc0e0
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], eax
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.1400bc0b0
lea rcx, [rsp + 0x68]
call fcn.14006fe00
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14007c7a0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r9d, 0x87
call fcn.140060640
lea rcx, [rsp + 0x58]
mov rdx, rdi
xor r8d, r8d
call fcn.14006fcd0
test esi, esi
js 0x14007c854
lea rcx, [rsp + 0x38]
call fcn.14007eed0
call fcn.1400bc040
test al, al
je 0x14007c820
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x38]
mov r8, rbx
call fcn.1400bc0e0
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x34]
lea rcx, [rsp + 0x38]
call fcn.1400bc0b0
jmp 0x14007c859
mov esi, 0xffffffff
lea rcx, [rsp + 0x58]
call fcn.14006fe00
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14007c880
Capabilities:
Get file size

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x9b
call fcn.140060640
lea rcx, [rsp + 0x48]
mov rdx, rdi
xor r8d, r8d
call fcn.14006fcd0
lea rcx, [rsp + 0x28]
call fcn.14007eed0
call fcn.1400bc040
test al, al
je 0x14007c8f3
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x28]
mov r8, rsi
xor r9d, r9d
call fcn.1400bc0e0
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400bc0b0
lea rcx, [rsp + 0x48]
call fcn.14006fe00
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401ca2e0
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x14007c940
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.SetLength
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xa8
call fcn.140060640
lea rcx, [rsp + 0x50]
mov rdx, rbx
xor r8d, r8d
call fcn.14006fcd0
lea rcx, [rsp + 0x30]
call fcn.14007eed0
call fcn.1400bc040
test al, al
je 0x14007c9b7
lea rdx, str.File::SetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
mov r9, rdi
call fcn.1400bc0e0
mov rcx, qword [rsi]
xor ebx, ebx
lea r8, [rsp + 0x28]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14007ca15
mov rcx, qword [rsi]
xor ebx, ebx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14007ca15
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14007ca13
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsi]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
jmp 0x14007ca15
xor ebx, ebx
lea rcx, [rsp + 0x30]
call fcn.1400bc0b0
lea rcx, [rsp + 0x50]
call fcn.14006fe00
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007d280
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.MapImageToMemory
lea r8, str..._.._base_files_memory_mapped_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x1a
call fcn.140060640
lea rcx, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call fcn.14006fcd0
mov rcx, rsi
call fcn.14007c2c0
test al, al
je 0x14007d372
lea rbx, [rsi + 0x40]
mov rcx, rsi
call fcn.14000de50
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rbx
mov rdx, rax
call fcn.14000c806
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14007d372
mov qword [rsp + 0x20], 0
xor edi, edi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x14007d372
lea rcx, [0x14020bbc8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1400d0448
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.14006fe00
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007eae0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14007eb0f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007eb12
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14007eb33
test bl, bl
je 0x14007eb82
cmp byte [rdi + 8], 0
je 0x14007eb74
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007eb77
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14007eb4a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007eb4d
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007eb63
xor edi, edi
jmp 0x14007ebfe
cmp byte [rdi + 8], 0
je 0x14007ebb6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007ebb9
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
je 0x14007eb93
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007eb96
mov rcx, qword [rdi]
call fcn.1400c0490
mov rcx, qword [0x14026da40]
mov dil, 1
test rcx, rcx
je 0x14007ebfe
mov edx, eax
mov r8d, esi
call fcn.1400be7b0
jmp 0x14007ebfe
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14007ebcc
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
je 0x14007ebdd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007ebe0
mov rcx, qword [rdi]
call fcn.1400c0490
mov rcx, qword [0x14026da40]
test rcx, rcx
je 0x14007ebfb
mov edx, eax
mov r8d, esi
call fcn.1400be7b0
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007f200
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov edi, r9d
mov r12, r8
mov rbx, rdx
mov r15, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x68], rax
shl ebp, 0x10
mov ecx, 0x10
call fcn.1401c9f10
mov rsi, rax
mov qword [rax], rbx
test r12, r12
setne byte [rax + 8]
mov dword [rax + 0xc], edi
lea rcx, [rsp + 0x58]
call fcn.1400703a0
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x14007f680]
xor ecx, ecx
mov rdx, r15
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
lea rcx, [rsp + 0x60]
call fcn.1400703a0
mov rax, qword [rsp + 0x60]
sub rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rcx, qword [0x14026b4f8]
test rcx, rcx
jne 0x14007f2d2
mov dword [rsp + 0x20], 1
lea rcx, str.Windows.CreateThreadTime
mov edx, 0x3e8
mov r8d, 0x989680
mov r9d, 0x32
call fcn.140063710
mov rcx, rax
mov qword [0x14026b4f8], rax
lea r14, [rsp + 0x30]
mov rdx, r14
call fcn.140065a50
test rdi, rdi
je 0x14007f2ef
test r12, r12
je 0x14007f31c
mov qword [r12], rdi
jmp 0x14007f325
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14007f308
mov edi, eax
cmp eax, 0x5af
je 0x14007f308
cmp edi, 0xe
jne 0x14007f346
mov rcx, r15
call fcn.14007e4e0
mov rcx, rsi
call fcn.1401c9f6c
xor esi, esi
jmp 0x14007f328
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov sil, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [0x14026b4f0]
mov ecx, dword [0x14026d938]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007f3b9
mov rcx, r14
mov edx, edi
call fcn.1400683b0
movzx eax, byte [rsp + 0x47]
test al, al
cmovs r14, qword [rsp + 0x30]
cmovs rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rax
mov rcx, qword [0x14026b4e8]
lea rdx, [rsp + 0x48]
call fcn.1400d0d50
cmp byte [rsp + 0x47], 0
jns 0x14007f310
mov rcx, qword [rsp + 0x30]
call fcn.1401c9f6c
jmp 0x14007f310
lea rcx, [0x14026b4f0]
call fcn.1401ca090
cmp dword [0x14026b4f0], 0xffffffff
jne 0x14007f367
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400d0d30
mov qword [0x14026b4e8], rax
lea rcx, [0x14026b4f0]
call fcn.1401ca128
jmp 0x14007f367

Function at 0x140080560
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x140080970
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0
mov r9d, 0x20019
or r9d, dword [rcx + 8]
mov rcx, qword [rcx]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140080a30
mov dword [rsp + 0x6c], 0
mov rcx, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140080a30
mov ebx, 0x91
cmp dword [rsp + 0x6c], 0
jne 0x140080a30
mov r8d, dword [rdi + 8]
mov rcx, qword [rdi]
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebx, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x140080a60
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140080adb
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140080adb
cmp dword [rsp + 0x38], 4
jne 0x140080adb
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140080b00
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
add rsp, 0x38
ret

Function at 0x140080b30
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, r8
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], 0xb
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 8
mov rcx, qword [rcx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140080bae
mov eax, dword [rsp + 0x4c]
or eax, 8
mov edi, 0x3f4
cmp eax, 0xb
jne 0x140080bae
cmp dword [rsp + 0x3c], 8
jne 0x140080bae
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
xor edi, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x140080bd0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rsi
push rdi
mov eax, 0x1048
call fcn.1401ca270
sub rsp, rax
mov rsi, r8
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140080c8a
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x140080c4f
mov edi, 0x3f4
cmp eax, 1
jne 0x140080c8a
lea rdx, [rsp + 0x840]
jmp 0x140080c80
lea rcx, [rsp + 0x840]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x140080c8a
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14003c12e
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x1048
pop rdi
pop rsi
ret

Function at 0x140080cb0
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], r8d
mov rcx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140080d10
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x140080d40
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.1401eaef4
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140080f70
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx], 0
je 0x1400810b0
cmp dword [rsi + 8], 0
js 0x1400810b0
lea r15, [rsi + 0x10]
mov ebp, 0xa
cmp byte [rsi + 0x27], 0
jns 0x140080fb9
mov ebp, dword [rsi + 0x20]
add ebp, 0xffffffff
mov dword [rsp + 0x44], ebp
lea r14, [rsi + 0x28]
mov eax, dword [rsi + 0x30]
mov rdi, qword [rsi + 0x28]
sub eax, edi
add eax, 0xfffffffe
and eax, 0xfffffffe
lea r12, [rsi + 0x40]
mov dword [rsi + 0x40], eax
lea rbx, [rsi + 0x44]
mov edx, ebp
mov rcx, r15
call fcn.14006d860
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x1400810ac
mov edx, dword [rsi + 0x40]
add rdx, 1
shr rdx, 1
mov rdi, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, rdi
mov rcx, rax
sar rcx, 1
sub rdx, rcx
jb 0x14008105f
mov word [rsp + 0x42], 0
add rdx, 1
lea r8, [rsp + 0x42]
mov rcx, r14
call fcn.1400813d0
mov rdi, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, rdi
add eax, 0xfffffffe
and eax, 0xfffffffe
mov dword [rsi + 0x40], eax
cmp dword [rsp + 0x44], ebp
mov edx, 0x4000
cmovne edx, ebp
mov dword [rsp + 0x44], edx
mov rcx, r15
call fcn.14006d860
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400810f2
lea rax, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x1400810bd
mov rax, qword [rax]
mov word [rax], 0
mov rax, qword [rsi + 0x28]
mov word [rax], 0
mov dword [rsi + 0x40], 0
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [r12]
add rax, 1
and rax, 0xfffffffffffffffe
mov rcx, qword [r14]
mov word [rcx + rax], 0
mov sil, 1
jmp 0x1400810d4

Function at 0x140081180
Capabilities:
Query or enumerate registry value

Disassembly:
add dword [rcx + 8], 0xffffffff
jmp fcn.140080f70