joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002a9c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push r14
push r15
mov eax, 0x2050
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov r14d, edx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x2000
call fcn.180113150
mov r8d, 0xf01ff
lea rdx, str.netbt
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x18002aa41
lea r9, [rsp + 0x38]
mov r8d, 0x2000
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov rcx, rbx
test eax, eax
jne 0x18002aa60
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x2050
pop r15
pop r14
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15d, dword [rsp + 0x60]
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlGroupOrderList
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18002aa41
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], 0x1ff8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.PNP_TDI
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18002aa41
mov qword [rsp + 0x2078], rbp
mov ebp, 1
mov qword [rsp + 0x2088], rdi
mov ebx, ebp
mov edi, dword [rsp + 0x38]
shr edi, 2
cmp edi, ebx
jbe 0x18002ab39
mov qword [rsp + 0x2080], rsi
lea rsi, [rsp + 0x44]
cmp r14d, dword [rsi]
jne 0x18002ab27
dec edi
lea rdx, [rsp + 0x40]
mov eax, edi
sub eax, ebx
movsxd r8, eax
lea eax, [rbx + 1]
movsxd rcx, eax
movsxd rax, ebx
shl r8, 2
lea rdx, [rdx + rcx*4]
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rax*4]
call fcn.180112cb0
inc ebx
add rsi, 4
cmp ebx, edi
jl 0x18002aaf5
mov rsi, qword [rsp + 0x2080]
movsxd rdx, edi
cmp rdx, rbp
jle 0x18002ab8a
mov rax, rbp
lea ecx, [rbp + 1]
cmp r15d, dword [rsp + rax*4 + 0x40]
je 0x18002ab5a
inc rax
mov ebp, ecx
cmp rax, rdx
jl 0x18002ab44
jmp 0x18002ab8a
movsxd rax, ebp
lea rbx, [rsp + 0x40]
inc edi
lea rbx, [rbx + rax*4]
mov eax, edi
sub eax, ebp
mov rdx, rbx
movsxd r8, eax
movsxd rax, ecx
lea rcx, [rsp + 0x40]
shl r8, 2
lea rcx, [rcx + rax*4]
call fcn.180112cb0
mov dword [rbx], r14d
mov r9d, dword [rsp + 0x3c]
lea eax, [rdi - 1]
mov rcx, qword [rsp + 0x30]
lea rdx, str.PNP_TDI
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea eax, [rdi*4]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x2088]
xor eax, eax
mov rbp, qword [rsp + 0x2078]
test ebx, ebx
sete al
jmp 0x18002aa43
Function at 0x18002abf0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov eax, 0x2050
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x2000
call fcn.180113150
lea r9, [rsp + 0x38]
mov r8d, 0x2000
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x18002ad6a
mov ebp, dword [rsp + 0x60]
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlGroupOrderList
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18002ad6a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], 0x1ff8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.PNP_TDI
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18002ad6a
mov qword [rsp + 0x2068], rsi
mov ebx, 1
mov esi, dword [rsp + 0x38]
shr esi, 2
cmp esi, ebx
jbe 0x18002ad16
mov qword [rsp + 0x2070], rdi
lea rdi, [rsp + 0x44]
cmp ebp, dword [rdi]
jne 0x18002ad04
dec esi
lea rdx, [rsp + 0x40]
mov eax, esi
sub eax, ebx
movsxd r8, eax
lea eax, [rbx + 1]
movsxd rcx, eax
movsxd rax, ebx
shl r8, 2
lea rdx, [rdx + rcx*4]
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rax*4]
call fcn.180112cb0
inc ebx
add rdi, 4
cmp ebx, esi
jl 0x18002acd3
mov rdi, qword [rsp + 0x2070]
mov r9d, dword [rsp + 0x3c]
lea eax, [rsi - 1]
mov rcx, qword [rsp + 0x30]
lea rdx, str.PNP_TDI
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea eax, [rsi*4]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2068]
xor eax, eax
test ebx, ebx
sete al
jmp 0x18002ad6c
xor eax, eax
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x2078]
add rsp, 0x2050
pop rbp
ret
Function at 0x18002b090
Capabilities:
Check if file exists
Delete file
Delete service
Get common file path
Move file

Disassembly:
push rdi
push r14
sub rsp, 0x258
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x18002b265
mov r8d, 0xf003f
mov qword [rsp + 0x250], rsi
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x18002b0fe
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x18002b25d
mov qword [rsp + 0x278], rbx
mov rcx, rsi
mov qword [rsp + 0x280], rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebx, ebx
jne 0x18002b133
cmp ebp, 0x430
mov eax, 1
cmove ebx, eax
mov rcx, rsi
call fcn.18002abf0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x280]
test ebx, ebx
je 0x18002b253
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180113150
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x18002b19d
xor edi, edi
jmp 0x18002b1a6
lea rcx, [rsp + 0x20]
call rax
mov edi, eax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18002b223
lea r8, str.Drivers_
mov edx, 0x103
lea rcx, [rsp + 0x30]
call fcn.180125a58
mov r8, r14
lea rcx, [rsp + 0x30]
mov edx, 0x103
call fcn.180125a58
lea r8, str..sys
mov edx, 0x103
lea rcx, [rsp + 0x30]
call fcn.180125a58
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18002b223
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x18002b223
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test edi, edi
je 0x18002b253
mov rdi, qword [rsp + 0x20]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002b253
mov rcx, rdi
call rax
mov eax, ebx
mov rbx, qword [rsp + 0x278]
mov rsi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x258
pop r14
pop rdi
ret
Function at 0x18002b280
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x290
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
mov r14, r9
mov esi, 1
call fcn.180113150
mov rdx, rdi
mov rcx, rbx
call sym.SafeBase64.dll_CopyDriverFile
lea r8, str.System32Drivers_
mov edx, 0x103
lea rcx, [rsp + 0x70]
call fcn.1801259f0
mov r8, rdi
lea rcx, [rsp + 0x70]
mov edx, 0x103
call fcn.180125a58
lea r8, str..sys
mov edx, 0x103
lea rcx, [rsp + 0x70]
call fcn.180125a58
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x18002b3cd
mov qword [rsp + 0x60], 0
lea rax, str.FltMgr
mov qword [rsp + 0x58], 0
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rax
mov r8, rdi
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], r14
mov rdx, rdi
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 2
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x18002b3b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x18002b3a1
mov edx, ebp
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
xor esi, esi
mov rcx, rdi
call sym.SafeBase64.dll_CheckDriverRemoved
test eax, eax
je 0x18002b3c2
mov edx, ebp
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
jmp 0x18002b3c2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x290
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002b3f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r12d, r8d
mov r14, rdx
mov r15, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.180113150
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180113150
mov dword [rsp + 0x40], 0x208
lea rbx, [rsp + 0x50]
lea rax, str.LowerFilters
lea r13, [0x180158ab0]
test r12d, r12d
cmove r13, rax
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x18002b470
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002b4c7
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
test eax, eax
je 0x18002b502
cmp eax, 2
jne 0x18002b5cd
mov dword [rsp + 0x40], edi
movzx eax, word [rbx]
test ax, ax
jne 0x18002b5bb
cmp word [rbx + 2], ax
jne 0x18002b5ad
mov r8, r14
mov edx, 0x103
lea rcx, [rsp + 0x260]
call fcn.1801259f0
mov ebx, dword [rsp + 0x40]
mov r8d, ebx
mov eax, esi
lea rcx, [rsp + 0x262]
lea rcx, [rcx + rax*2]
lea rdx, [rsp + 0x50]
call fcn.180112cb0
lea ebx, [rbx + rsi*2]
add ebx, 2
mov esi, 0x208
mov r8d, esi
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180113150
cmp ebx, esi
cmova ebx, esi
mov r8d, ebx
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
call fcn.180112cb0
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete dil
jmp 0x18002b5cd
test ax, ax
jne 0x18002b5bb
add rbx, 2
mov qword [rsp + 0x30], rbx
mov rdx, r14
mov rcx, rbx
call fcn.1801153c8
test eax, eax
jne 0x18002b602
lea edi, [rax + 1]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x18002b5fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, r12d
mov r8, r14
mov rdx, r15
lea rcx, str.AddClassFilter::_Failed__ClassName_s__szServiceName_s__bUpperFilter_x_GetLastError_returned__u_n
call sym.SafeBase64.dll_DbgPrintW
mov eax, edi
jmp 0x18002b4a4
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x18002b610
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x30], rbx
jmp 0x18002b502
Function at 0x18002b630
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r13d, r8d
mov r14, rdx
mov r15, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180113150
mov dword [rsp + 0x40], 0x208
lea rbx, [rsp + 0x50]
lea rax, str.LowerFilters
lea r12, [0x180158ab0]
test r13d, r13d
cmove r12, rax
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x18002b6a0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002b6f7
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18002b730
xor edi, edi
cmp eax, 2
jmp 0x18002b7f8
movzx eax, word [rbx]
test ax, ax
jne 0x18002b756
cmp word [rbx + 2], ax
jne 0x18002b748
mov edi, 1
jmp 0x18002b7fc
test ax, ax
jne 0x18002b756
add rbx, 2
mov qword [rsp + 0x30], rbx
mov rdx, r14
mov rcx, rbx
call fcn.1801153c8
test eax, eax
jne 0x18002b831
lea rax, [rsp + 0x50]
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov r9d, esi
lea rdx, [r9 + rcx]
add rdx, rdx
mov r8d, dword [rsp + 0x40]
cmp r8, rdx
jbe 0x18002b7ab
mov edi, 1
sub edi, ecx
sub edi, esi
lea r8d, [r8 + rdi*2]
inc r9
lea rdx, [rbx + r9*2]
mov rcx, rbx
call fcn.180112cb0
xor edi, edi
jmp 0x18002b7c5
xor edi, edi
mov word [rbx], di
lea rax, [rbx + 2]
mov qword [rsp + 0x30], rax
mov word [rax], di
add rax, 2
mov qword [rsp + 0x30], rax
lea eax, [rsi + rsi]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
sub ecx, 2
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x18002b82a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, r13d
mov r8, r14
mov rdx, r15
lea rcx, str.RemoveClassFilter::_Failed__ClassName_s__szServiceName_s__bUpperFilter_x_GetLastError_returned__u_n
call sym.SafeBase64.dll_DbgPrintW
mov eax, edi
jmp 0x18002b6d4
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x18002b840
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x30], rbx
jmp 0x18002b730
Function at 0x18002b860
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov ebx, r8d
mov r15, rdx
mov r12, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.180113150
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180113150
mov dword [rsp + 0x48], 0x208
lea rdi, [rsp + 0x50]
xor esi, esi
mov r14d, esi
lea rax, str.LowerFilters
lea r13, [0x180158ab0]
test ebx, ebx
cmove r13, rax
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r15 + rbx*2], si
jne 0x18002b8f0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002b950
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18002babc
movzx eax, word [rdi]
test ax, ax
jne 0x18002b9a0
cmp word [rdi + 2], ax
je 0x18002babc
test ax, ax
jne 0x18002b9a0
add rdi, 2
mov qword [rsp + 0x30], rdi
inc r14d
mov dword [rsp + 0x38], r14d
mov rdx, r15
mov rcx, rdi
call fcn.1801153c8
test eax, eax
jne 0x18002bace
cmp r14d, 1
je 0x18002babc
lea rax, [rsp + 0x50]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov r14d, ebx
lea rdx, [r14 + rcx]
add rdx, rdx
mov r8d, dword [rsp + 0x48]
cmp r8, rdx
jbe 0x18002ba06
mov eax, 1
sub eax, ecx
sub eax, ebx
lea r8d, [r8 + rax*2]
lea rdx, [r14 + 1]
lea rdx, [rdi + rdx*2]
mov rcx, rdi
call fcn.180112cb0
jmp 0x18002ba21
mov word [rdi], si
lea rax, [rdi + 2]
mov qword [rsp + 0x30], rax
mov word [rax], si
add rax, 2
mov qword [rsp + 0x30], rax
mov r14d, ebx
lea eax, [rbx + rbx]
mov ebx, dword [rsp + 0x48]
sub ebx, eax
sub ebx, 2
mov r8, r15
mov edx, 0x103
lea rcx, [rsp + 0x260]
call fcn.1801259f0
mov r8d, ebx
lea rcx, [rsp + 0x262]
lea rcx, [rcx + r14*2]
lea rdx, [rsp + 0x50]
call fcn.180112cb0
mov edi, 0x208
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180113150
mov ebx, dword [rsp + 0x48]
cmp ebx, edi
cmova ebx, edi
mov dword [rsp + 0x48], ebx
mov r8d, ebx
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
call fcn.180112cb0
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete sil
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x18002b923
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x18002bad5
lea rdi, [rdi + rax*2]
mov qword [rsp + 0x30], rdi
jmp 0x18002b980
Function at 0x18002baf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebx, r8d
mov r12, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180113150
mov dword [rsp + 0x48], 0x208
lea rsi, [rsp + 0x50]
xor r14d, r14d
mov r15d, r14d
lea rax, str.LowerFilters
lea r13, [0x180158ab0]
test ebx, ebx
cmove r13, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002bbb4
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18002bc35
movzx eax, word [rsi]
test ax, ax
jne 0x18002bbfc
cmp word [rsi + 2], ax
je 0x18002bc35
test ax, ax
jne 0x18002bbfc
add rsi, 2
mov qword [rsp + 0x38], rsi
inc r14d
mov dword [rsp + 0x30], r14d
mov rdx, r12
mov rcx, rsi
call fcn.1801153c8
test eax, eax
jne 0x18002bc19
lea r15d, [rax + 1]
jmp 0x18002bc35
mov rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x18002bc20
lea rsi, [rsi + rax*2]
mov qword [rsp + 0x38], rsi
jmp 0x18002bbe0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
cmovne r15d, r14d
mov eax, r15d
jmp 0x18002bb87
Function at 0x18002bc50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r14, rcx
mov r15d, 0x208
mov r8d, r15d
xor edx, edx
lea rcx, [rsp + 0x260]
call fcn.180113150
mov r8d, r15d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180113150
mov dword [rsp + 0x40], r15d
lea rbx, [rsp + 0x50]
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x18002bcb3
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002bd14
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DumpFilters
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
test eax, eax
je 0x18002bd53
cmp eax, 2
jne 0x18002be1f
mov dword [rsp + 0x40], edi
movzx eax, word [rbx]
test ax, ax
jne 0x18002be0d
cmp word [rbx + 2], ax
jne 0x18002bdff
mov r8, r14
mov edx, 0x103
lea rcx, [rsp + 0x260]
call fcn.1801259f0
mov ebx, dword [rsp + 0x40]
mov r8d, ebx
mov eax, esi
lea rcx, [rsp + 0x262]
lea rcx, [rcx + rax*2]
lea rdx, [rsp + 0x50]
call fcn.180112cb0
lea ebx, [rbx + rsi*2]
add ebx, 2
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180113150
cmp ebx, r15d
cmova ebx, r15d
mov r8d, ebx
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
call fcn.180112cb0
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
lea rdx, str.DumpFilters
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete dil
jmp 0x18002be1f
test ax, ax
jne 0x18002be0d
add rbx, 2
mov qword [rsp + 0x30], rbx
mov rdx, r14
mov rcx, rbx
call fcn.1801153c8
test eax, eax
jne 0x18002be4d
lea edi, [rax + 1]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x18002be46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, r14
lea rcx, str.AddClassFilter::_Failed__szServiceName_s__GetLastError_returned__u_n
call sym.SafeBase64.dll_DbgPrintW
mov eax, edi
jmp 0x18002bceb
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x18002be54
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x30], rbx
jmp 0x18002bd53