joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039380
Capabilities:
Get volume information via ioctl

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, r9
mov r15, r8
mov r13, rdx
mov r14, rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [r14 + 0x94], 1
je 0x14003940e
lea ecx, [r12 + 0x32]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x140039536
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x60
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90064
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140039407
mov ebp, dword [rsp + 0xa0]
add ebp, 0xf
xorps xmm0, xmm0
mov edi, ebp
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
je 0x14003948d
lfence
mov ecx, edi
call fcn.14000e8a0
mov qword [rsp + 0x48], rax
lea rbx, [rax + rbp]
mov qword [rsp + 0x58], rbx
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.1400d41f0
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x48]
mov rax, qword [r13 + 0x58]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rsp + 0x60]
mov edx, 0x90068
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400394f9
lea rax, [rbx + 0xc]
movzx ecx, word [rax + 0x14]
add rcx, rax
mov edx, dword [rax + 0x18]
add rdx, rax
cmp rcx, rdx
jae 0x1400394f9
cmp dword [rcx], 0x80
je 0x14003955a
mov eax, dword [rcx + 4]
add rcx, rax
cmp rcx, rdx
jb 0x1400394e6
xor bl, bl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140039533
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003952e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039595
call fcn.1400ada10
movzx eax, bl
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [rcx + 0x10]
movzx edi, word [rcx + 0x14]
add rdi, rcx
je 0x1400394f9
test eax, eax
je 0x1400394f9
test rsi, rsi
je 0x140039574
cmp esi, eax
cmovb eax, esi
mov ebx, eax
mov edx, eax
mov rcx, r15
call fcn.14001db60
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [r15]
call fcn.1400d44b0
mov bl, 1
jmp 0x1400394fb
call fcn.1400e39e0
int3
Function at 0x140052330
Capabilities:
Hash data using murmur3

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
cmp dword [rcx], 0
jne 0x1400524c3
mov r8, qword [rcx + 0x10]
sub r8, qword [rcx + 8]
sar r8, 4
cmp r8, 2
jle 0x1400524c3
mov qword [rax - 0x28], rdx
movups xmm0, xmmword [rdx]
movups xmmword [rax - 0x20], xmm0
movsd xmm1, qword [rdx + 0x10]
movsd qword [rax - 0x10], xmm1
mov ebx, 1
mov rcx, r8
shr rcx, 1
add rcx, r8
cmp rbx, rcx
jae 0x14005239e
add rbx, rbx
cmp rbx, rcx
jb 0x140052396
lea rbp, [rbx*8]
mov rdx, rbp
mov rcx, r14
call fcn.140051080
mov rdi, rax
test rax, rax
jne 0x1400523e7
mov rcx, qword [r14]
mov rdi, qword [rsp + 0x28]
cmp rcx, rdi
je 0x1400523d6
mov rbx, qword [rcx]
call fcn.1400e3bf4
mov rcx, rbx
cmp rbx, rdi
jne 0x1400523c6
mov qword [r14], rdi
mov rax, qword [rsp + 0x30]
mov qword [r14 + 8], rax
jmp 0x14005254d
mov r8, rbp
xor edx, edx
mov rcx, rdi
call fcn.1400d41f0
mov rbp, qword [rsi + 8]
mov r11, rbp
cmp rbp, qword [rsi + 0x10]
je 0x140052491
mov rax, qword [r11 + 8]
test rax, rax
je 0x140052413
xor r8d, r8d
jmp 0x140052416
mov r8, qword [r11]
test rax, rax
cmovne r8, rax
test r8, r8
je 0x140052483
mov eax, r8d
shr eax, 0x10
xor eax, r8d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
lea r10, [rbx - 1]
and rax, r10
xor ecx, ecx
nop
lea r9, [rdi + rax*8]
mov rdx, qword [r9]
test rdx, rdx
je 0x140052474
cmp rdx, r8
je 0x140052483
inc rax
add rax, rcx
and rax, r10
inc rcx
cmp rcx, r10
jbe 0x140052450
jmp 0x140052483
mov qword [r9], r8
movups xmm0, xmmword [r11]
movups xmmword [rbp], xmm0
add rbp, 0x10
add r11, 0x10
cmp r11, qword [rsi + 0x10]
jne 0x140052405
mov qword [rsi + 0x10], rbp
mov rcx, qword [r14]
mov rdi, qword [rsp + 0x28]
cmp rcx, rdi
je 0x1400524b2
mov rbx, qword [rcx]
call fcn.1400e3bf4
mov rcx, rbx
cmp rbx, rdi
jne 0x1400524a2
mov qword [r14], rdi
mov rax, qword [rsp + 0x30]
mov qword [r14 + 8], rax
jmp 0x14005254d
mov r11, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov rdx, r11
sub rdx, rcx
mov rax, rdx
and rax, 0xfffffffffffffff0
cmp rax, 0x10
jle 0x14005250c
mov r10, qword [rcx]
mov r9, qword [rcx + 0x10]
cmp r10, r9
jne 0x1400524f4
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 8], rax
je 0x14005250c
add rcx, 0x10
sub rdx, 0x10
mov r10, r9
mov rax, rdx
and rax, 0xfffffffffffffff0
cmp rax, 0x10
jg 0x1400524e1
cmp rcx, r11
je 0x140052549
mov rdx, rcx
add rcx, 0x10
cmp rcx, r11
je 0x140052545
nop dword [rax]
mov rax, qword [rdx]
cmp qword [rcx], rax
jne 0x140052532
mov rax, qword [rdx + 8]
cmp qword [rcx + 8], rax
je 0x14005253c
movups xmm0, xmmword [rcx]
add rdx, 0x10
movups xmmword [rdx], xmm0
add rcx, 0x10
cmp rcx, r11
jne 0x140052520
lea rcx, [rdx + 0x10]
mov qword [rsi + 0x10], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140058800
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [rdx]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
mov r9, rdx
test al, al
je 0x140058835
movsx eax, al
lea r9, [r9 + 1]
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
movzx eax, byte [r9]
test al, al
jne 0x140058813
lea eax, [r8 + r8*8]
mov ecx, eax
shr rax, 0xb
xor rax, rcx
and eax, 0x3f
mov r8, qword [r10 + rax*8]
test r8, r8
je 0x1400588a1
nop
mov ecx, dword [r8]
sub ecx, 1
je 0x140058877
sub ecx, 1
je 0x140058871
sub ecx, 1
je 0x140058871
cmp ecx, 1
je 0x14005886b
xor eax, eax
jmp 0x14005887b
lea rax, [r8 + 0x11]
jmp 0x14005887b
lea rax, [r8 + 0x18]
jmp 0x14005887b
lea rax, [r8 + 0x38]
mov r9, r11
sub r9, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140058894
inc rax
test ecx, ecx
jne 0x140058881
test edx, edx
je 0x1400588a4
mov r8, qword [r8 + 8]
test r8, r8
jne 0x140058850
xor eax, eax
ret
mov rax, r8
ret
Function at 0x14006ca20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov edi, ebp
mov qword [rsp + 0x50], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006ca7b
mov eax, ebp
mov rdi, qword [rsp + 0x50]
test eax, eax
jne 0x14006cb5a
mov rbx, rbp
mov esi, ebp
mov qword [rsp + 0x50], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401387e0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006cad7
mov esi, dword [rsp + 0x58]
mov eax, ebp
mov rbx, qword [rsp + 0x50]
test eax, eax
jne 0x14006cb4c
mov dword [rsp + 0x60], ebp
cmp esi, 1
je 0x14006cb1d
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.cadca5fe_87d3_4b96_b7fb_a231484277cc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x14006cb4c
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.cadca5fe_87d3_4b96_b7fb_a231484277cc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14006cb5a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x14006cb68
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ad9f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140072610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
jne 0x1400726b1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140072661
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14000b840
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400ad9f0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rdi
ret
lea rdx, [0x140138df8]
lea rcx, [rsp + 0x38]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x38]
mov ecx, edi
call fcn.1400725e0
int3
Function at 0x140078710
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x40]
xor eax, eax
mov rbx, r8
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], eax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140078766
mov dword [rsp + 0x30], eax
lea rax, [0x140162ce0]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x50
pop rbx
ret

Function at 0x140078780
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x68], rdx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], r14
mov qword [rdx + 8], r14
mov qword [rdx + 0x10], r14
mov edi, 1
mov dword [rsp + 0x40], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.1400d41f0
xor edx, edx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x70], 0x104
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x80]
mov rcx, qword [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400788e4
mov r8d, dword [rsp + 0x70]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14000b840
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14007887f
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x48], r14w
add qword [rbx + 8], 0x20
jmp 0x140078891
lea r8, [rsp + 0x48]
mov rcx, rbx
call fcn.140079770
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400788ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400788c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007890e
call fcn.1400ada10
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.1400d41f0
mov edx, edi
inc edi
jmp 0x1400787ee
mov rax, rbx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400ad9f0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400e39e0
int3
Function at 0x140078920
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x68], rdx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], r14
mov qword [rdx + 8], r14
mov qword [rdx + 0x10], r14
mov edi, 1
mov dword [rsp + 0x40], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.1400d41f0
xor edx, edx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x70], 0x104
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x80]
mov rcx, qword [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140078a84
mov r8d, dword [rsp + 0x70]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14000b840
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140078a1f
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x48], r14w
add qword [rbx + 8], 0x20
jmp 0x140078a31
lea r8, [rsp + 0x48]
mov rcx, rbx
call fcn.140079770
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140078a6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078a65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078aae
call fcn.1400ada10
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.1400d41f0
mov edx, edi
inc edi
jmp 0x14007898e
mov rax, rbx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400ad9f0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400e39e0
int3

Function at 0x140078ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140078b1e
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x60
pop rbx
ret
lea rdx, str.Failed_to_get_registry_value
lea rcx, [rsp + 0x30]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140010730
int3
Function at 0x140078ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140078bff
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x70
pop rbx
ret
lea rdx, str.Failed_to_get_registry_value
lea rcx, [rsp + 0x30]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140010730
int3

Function at 0x140078d50
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov r10, rdx
mov rdx, qword [r8 + 0x10]
cmp rdx, 0x7ffffffe
ja 0x140078dd4
mov eax, edx
cmp rax, rdx
jne 0x140078da9
lea eax, [rdx*2 + 2]
cmp qword [r8 + 0x18], 8
jb 0x140078d7e
mov r8, qword [r8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
mov rdx, r10
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x140078df7
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.140079930
lea rdx, [0x1401602a0]
lea rcx, [rsp + 0x30]
call fcn.1400d4390
int3
lea rdx, str.Failed_to_set_registry_string_value___size_too_big
lea rcx, [rsp + 0x30]
call fcn.140010540
lea rdx, [0x140160050]
lea rcx, [rsp + 0x30]
call fcn.1400d4390
int3
lea rdx, str.Failed_to_set_registry_string_value
lea rcx, [rsp + 0x30]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140010730
int3

Function at 0x140079080
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1400790d8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x60
pop rbx
ret
lea rdx, str.Failed_to_set_registry_value_of_type_DWORD
lea rcx, [rsp + 0x30]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140010730
int3

Function at 0x140079100
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r8
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x140079158
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x60
pop rbx
ret
lea rdx, str.Failed_to_set_registry_value_of_type_QWORD
lea rcx, [rsp + 0x30]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140010730
int3
Function at 0x140079180
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, 0xfffffffd
jne 0x14007919f
add rsp, 0x40
pop rbx
ret
lea rdx, str.Failed_to_delete_key
lea rcx, [rsp + 0x20]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140010730
int3

Function at 0x1400791c0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, 0xfffffffd
jne 0x1400791df
add rsp, 0x40
pop rbx
ret
lea rdx, str.Failed_to_delete_subtree
lea rcx, [rsp + 0x20]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140010730
int3

Function at 0x140079200
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test eax, eax
je 0x140079223
cmp eax, 2
jne 0x14007922b
xor al, al
add rsp, 0x40
pop rbx
ret
mov al, 1
add rsp, 0x40
pop rbx
ret
lea rdx, str.Failed_to_delete_value
lea rcx, [rsp + 0x20]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140010730
int3

Function at 0x140079250
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400792b4
mov edx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
call fcn.140077f80
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x60
pop rbx
ret
lea rdx, str.Failed_to_get_registry_value_length
lea rcx, [rsp + 0x30]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140010730
int3
Function at 0x1400792e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x61], r8
mov rbx, rdx
mov r13, rcx
mov qword [rbp - 0x19], rdx
mov dword [rbp - 0x39], r9d
xor esi, esi
test r9d, r9d
jne 0x140079337
mov qword [rdx], rsi
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], 7
mov word [rdx], si
jmp 0x140079477
shr r9d, 1
xorps xmm0, xmm0
mov word [rbp - 0x69], si
mov r12d, r9d
movdqu xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x21], rsi
test r9d, r9d
je 0x140079392
lfence
lea r15, [r9 + r9]
mov rcx, r15
call fcn.14000e8a0
mov rdi, rax
mov qword [rbp - 0x31], rax
lea r14, [r15 + rax]
mov qword [rbp - 0x21], r14
cmp word [rbp - 0x69], si
jne 0x140079385
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.1400d41f0
jmp 0x14007938e
movzx eax, si
mov rcx, r12
rep stosw word [rdi], ax
mov qword [rbp - 0x29], r14
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x19]
xor r8d, r8d
mov rdx, qword [rbp - 0x61]
mov rcx, qword [r13 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400794e1
mov edx, dword [rbp - 0x39]
mov ecx, dword [rbp - 0x19]
call fcn.140077f80
mov rcx, qword [rbp - 0x31]
cmp dword [rbp - 0x39], edi
je 0x14007949a
mov r8, qword [rbp - 0x29]
mov rax, r8
sub rax, rcx
sar rax, 1
cmp rax, 2
jb 0x14007949a
lea rax, [r8 - 2]
cmp word [rax], di
cmove r8, rax
mov qword [rbp - 0x29], r8
mov qword [rbp - 0x11], rsi
mov qword [rbp - 1], rsi
mov qword [rbp + 7], 7
cmp rcx, r8
je 0x14007942c
sub r8, rcx
sar r8, 1
mov rdx, rcx
lea rcx, [rbp - 0x11]
call fcn.14000b840
mov rcx, qword [rbp - 0x31]
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 1]
movups xmmword [rbx + 0x10], xmm1
test rcx, rcx
je 0x140079477
mov rdx, qword [rbp - 0x21]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079472
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400794fe
call fcn.1400ada10
mov rax, rbx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
test rcx, rcx
je 0x140079477
mov rdx, qword [rbp - 0x21]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079472
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400794fe
jmp 0x140079472
lea rdx, str.Failed_to_get_registry_value_length
lea rcx, [rbp - 0x59]
call fcn.14000a4a0
nop
lea rdx, [rbp - 0x59]
mov ecx, edi
call fcn.140010730
nop
call fcn.1400e39e0
int3