joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033e10
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
mov eax, dword [0x14064c818]
mov ebx, ecx
mov edx, eax
inc eax
mov dword [0x14064c818], eax
test edx, edx
jne 0x140033ed7
mov rax, qword [sym.imp.msvcrt.dll_malloc]
mov qword [sub.msvcrt.dll_malloc], rax
mov rax, qword [sym.imp.msvcrt.dll_free]
mov qword [fcn.14000409c], rax
mov rax, qword [sym.imp.msvcrt.dll_realloc]
mov qword [0x140649468], rax
lea rax, case.0x14003c377.0
mov qword [case.0x14003c377.11], rax
mov rax, qword [sym.imp.msvcrt.dll_calloc]
mov qword [case.0x14003c377.1], rax
test cl, 1
je 0x140033e87
call fcn.14003d9a0
test eax, eax
je 0x140033ee8
test bl, 2
je 0x140033eba
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x140033ee8
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x140033ee2
shr ax, 8
cmp al, 2
jne 0x140033ee2
call fcn.14003e060
test eax, eax
jne 0x140033ee8
mov eax, dword [0x14064c87c]
test bl, 4
mov ecx, 1
cmovne eax, ecx
mov dword [0x14064c81c], ebx
mov dword [0x14064c87c], eax
xor eax, eax
add rsp, 0x1c0
pop rbx
ret
call qword [sym.imp.WSOCK32.DLL_WSACleanup]
mov eax, 2
add rsp, 0x1c0
pop rbx
ret

Function at 0x140038c40
Capabilities:
Write file on windows

Disassembly:
mov rdx, qword [r8 + 0x10]
mov r9, rcx
or rax, 0xffffffffffffffff
mov qword [r8 + 0x18], rdx
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140038c50
test rax, rax
je 0x140038c6a
cmp byte [rdx + rax - 1], 0x2e
jne 0x140038c6a
mov byte [rdx + rax - 1], 0
mov rcx, qword [r8 + 0x10]
movzx eax, byte [rcx]
test al, al
je 0x140038c94
lea rcx, [rcx + 1]
and al, 0x80
jne 0x140038c85
movzx eax, byte [rcx]
test al, al
jne 0x140038c75
ret
lea rdx, str.IDN_support_not_present__cant_parse_Unicode_domains_n
mov rcx, r9
jmp fcn.14003e620
ret
Function at 0x14003ed80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rcx + 0x258]
mov rdi, r9
mov rsi, r8
mov rbx, rcx
test r10, r10
je 0x14003edc3
mov rax, qword [rcx + 0x1a8]
mov qword [rsp + 0x20], rax
call r10
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
ja 0x14003ee08
mov r9, qword [rbx + 0x1a0]
movsxd rax, edx
mov edx, 2
lea rcx, [rax + rax*2]
lea rax, [0x140072fc8]
lea r8d, [rdx - 1]
add rcx, rax
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x1a0]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fwrite]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140041dc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x798]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x140041e2d
mov rax, qword [rcx + 0x80]
test rax, rax
jne 0x140041df3
cmp qword [rcx + 0x78], rax
je 0x140041e2d
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 0
test rax, rax
jne 0x140041e06
mov rax, qword [rcx + 0x78]
mov rcx, qword [rax + 0x60]
lea r8, [0x140042d40]
lea rdx, [rsp + 0x20]
call fcn.14004ac40
cmp byte [rsp + 0x28], 0
jne 0x140041e41
mov qword [rdi + 0x798], 0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rsi, rsi
je 0x140041e49
mov qword [rsi], rbx
cmp byte [rbx + 0x1f0], 0
mov rdi, qword [rbx + 0x1a8]
je 0x140041e67
mov rcx, rbx
call fcn.14003d330
test eax, eax
jne 0x140041e83
jmp 0x140041e2d
mov r9d, 2
lea rdx, [rsp + 0x40]
mov rcx, rdi
lea r8d, [r9 - 1]
call qword [sym.imp.WSOCK32.DLL_recv]
test eax, eax
je 0x140041e2d
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400423f0
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xd0
mov dword [rax + 0x18], 0x4020
mov dword [rax + 0x10], 0
mov dword [rax + 0x20], 4
mov eax, dword [0x14064c840]
mov rbx, rcx
test eax, eax
jne 0x140042485
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x9c
call sub.msvcrt.dll_memset
mov r8b, 3
mov edx, 2
xor ecx, ecx
mov dword [rsp + 0x30], 0x9c
mov dword [rsp + 0x34], 6
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0x30]
mov edx, 2
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x140042479
mov dword [0x14064c840], 2
add rsp, 0xd0
pop rbx
ret
mov dword [0x14064c840], 1
jmp 0x14004248a
cmp eax, 2
je 0x1400424eb
lea rax, [rsp + 0xf8]
lea r9, [rsp + 0xe8]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WSOCK32.DLL_getsockopt]
test eax, eax
jne 0x1400424c7
mov eax, dword [rsp + 0xf0]
cmp dword [rsp + 0xe8], eax
jg 0x1400424eb
lea r9, [rsp + 0xf0]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WSOCK32.DLL_setsockopt]
add rsp, 0xd0
pop rbx
ret
Function at 0x14005e310
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x14064c8d0], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x14064c8e0]
jne 0x14005e35d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x14064c908], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x14064c8d0], 1
mov ecx, dword [0x14064c908]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x14005e432
mov rcx, qword [0x14064b7a0]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14005e45d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14064c8d8]
test rax, rax
je 0x14005e3ad
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x14064c8d8], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x14005e478]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x14064c908]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x14064b7a0]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14005e45d
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140001110
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x578
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov eax, dword [0x1400a4008]
test eax, 0xc000000
je 0x14000114b
test ecx, eax
jne 0x1400011bf
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140001170
add rsp, 0x578
pop rdi
pop rbx
ret
mov r8, rdx
mov edi, 0x1ff
lea r9, [r11 + 0x18]
lea rcx, [r11 - 0x428]
xor ebx, ebx
mov rdx, rdi
mov word [rsp + 0x160], bx
call sub.msvcrt.dll__vsnwprintf
cmp eax, ebx
jl 0x14000114b
cdqe
cmp rax, rdi
ja 0x14000114b
je 0x140024a16
mov eax, dword [0x1400a4008]
bt eax, 0x1b
jae 0x1400012cb
cmp qword [0x1400a4010], rbx
je 0x1400012cb
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x5a]
movzx edx, word [rsp + 0x58]
movzx r8d, word [rsp + 0x56]
movzx r11d, word [rsp + 0x5e]
movzx eax, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x52]
movzx r9d, word [rsp + 0x50]
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
lea rcx, [rsp + 0x60]
lea r8, str.__d__02d__02d__02d:_02d:_02d._03d_
mov edx, 0x80
mov dword [rsp + 0x20], r10d
call fcn.1400012fc
cmp eax, ebx
jl 0x140001292
mov rdx, qword [0x1400a4010]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_fputws
mov rdx, qword [0x1400a4010]
lea rcx, [rsp + 0x160]
call sub.msvcrt.dll_fputws
mov rdx, qword [0x1400a4010]
lea rcx, [0x140053970]
call sub.msvcrt.dll_fputws
mov rcx, qword [0x1400a4010]
call sub.msvcrt.dll_fflush
mov eax, dword [0x1400a4008]
bt eax, 0x1a
jae 0x14000114b
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x140053970]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
jmp 0x14000114b
mov word [rsp + 0x55e], bx
jmp 0x1400011fd
Function at 0x140001170
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x1400162f2
rol rcx, 0x10
test cx, 0xffff
jne 0x1400162ee
ret 0
ror rcx, 0x10
jmp 0x14004ddb0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400a50f0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1400a51e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14004de35
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400a50f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x14004de57
mov rax, qword [rsp + 0x88]
mov qword [0x1400a51e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400a5188], rax
mov rax, qword [0x1400a51e8]
mov qword [0x1400a5060], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400a5170], rax
mov dword [0x1400a5050], 0xc0000409
mov dword [0x1400a5054], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400a44d0]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, str.PP_n_
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000f3d4
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push r12
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400171ed
test rcx, rcx
je 0x1400171f7
and qword [rdx], 0
and qword [rsp + 0x48], 0
and dword [rsp + 0x90], 0
and dword [rsp + 0x98], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
xor r8d, r8d
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140017248
mov ecx, dword [rsp + 0x90]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400025a0
mov r12, rax
mov qword [rsp + 0x48], rax
jmp 0x14000f48f
test r12, r12
je 0x14001723e
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsi], rax
test rax, rax
je 0x140017234
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x98]
mov r8, rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x14001721b
xor ebx, ebx
jmp 0x14000f4ef
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x14000f4f9
mov eax, ebx
add rsp, 0x60
pop r12
pop rsi
pop rbx
ret
mov eax, 0x80004003
jmp 0x14000f4fb
mov eax, 0x80070057
jmp 0x14000f4fb
call fcn.140028c78
mov ebx, eax
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_free]
and qword [rsi], 0
jmp 0x14000f4ef
mov ebx, 0x8007000e
jmp 0x14000f4ef
mov ebx, 0x8007000e
jmp 0x14000f4f9
mov ecx, eax
call fcn.140029984
mov ebx, eax
jmp 0x14000f4f9
Function at 0x140014734
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140013e8c
add rsp, 0x28
jmp 0x14001474c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x1400a4e38], rdi
jne 0x140024c8f
mov eax, dword [0x1400a4e30]
cmp eax, 1
je 0x140024caf
mov eax, dword [0x1400a4e30]
cmp eax, ebx
jne 0x140024cc6
mov dword [0x1400a4e30], 1
lea r13, [0x14005ad30]
lea rdi, [0x14005ad18]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x1400147f8
cmp eax, ebx
jne 0x1400147f8
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x1400147ed
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400147d6
cmp eax, ebx
jne 0x140024cbc
mov eax, dword [0x1400a4e30]
cmp eax, 1
jne 0x140014828
lea rdx, [0x14005ad10]
lea rcx, [0x14005acc8]
call 0x14013a000
mov dword [0x1400a4e30], 2
cmp r12d, ebx
jne 0x140014837
mov rax, rbx
xchg qword [0x1400a4e38], rax
cmp qword [0x1400a4e50], rbx
jne 0x140024cd5
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x140024cfe
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
jbe 0x14001487b
cmp word [rcx], 0x22
je 0x140024d59
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140014860
cmp word [rcx], bx
jne 0x140024d08
cmp word [rcx], bx
jne 0x140024d15
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400148d0
nop
jmp 0x140024d2d
cmp rax, rdi
jne 0x140024c9f
mov r12d, 1
jmp 0x140014796
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014785
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140014800
mov eax, 0xff
jmp 0x140024d98
mov dword [0x1400a5048], 1
jmp 0x140014800
lea rcx, [0x1400a4e50]
call fcn.14004dd4c
cmp eax, ebx
je 0x140014844
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1400a4e50]
nop
jmp 0x140014844
mov eax, 0xff
jmp 0x140024d98
cmp edx, ebx
je 0x140014884
jmp 0x140014866
cmp word [rcx], 0x20
ja 0x14001488d
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140014884
mov dword [0x1400a5044], eax
cmp dword [0x1400a474c], ebx
jne 0x140024d43
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400a5048], ebx
jne 0x140024d57
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400a5044]
jmp 0x140024d98
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x140014870
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x140015c24
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp byte [rcx + 0x70], dil
jne 0x140015c57
mov byte [rcx + 0x70], 1
lea rcx, str.ehETW.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x78], rax
cmp rax, rdi
jne 0x140024ae2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, str.ehCreatePerfLog
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.ehClosePrefLog
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.EHOME_EVENT_TRACE
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.EHOME_EVENT_TRACE_U
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.EHOME_EVENT_TRACE_US
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x78]
lea rdx, str.ehETWTracingEnabled
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, qword [rbx + 0x18]
mov qword [rbx + 0x28], rax
cmp r8, rdi
je 0x140024bb2
cmp qword [rbx + 0x20], rdi
je 0x140024bb2
cmp qword [rbx], rdi
je 0x140024bb2
cmp qword [rbx + 8], rdi
je 0x140024bb2
cmp qword [rbx + 0x10], rdi
je 0x140024bb2
cmp rax, rdi
je 0x140024bb2
mov rcx, qword [rbx + 0x60]
lea rdx, [rbx + 0x30]
call r8
mov qword [rbx + 0x68], rax
cmp rax, rdi
jne 0x140015c57
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x28], rdi
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x78], rdi
jmp 0x140015c57
Function at 0x140015c70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rdx, [rsp + 0x60]
lea rcx, str.MediaCenter_EnabledSku
xor edi, edi
mov dword [rsp + 0x60], edi
call sub.slc.dll_SLGetWindowsInformationDWORD
mov ecx, dword [rsp + 0x60]
cmp eax, edi
lea rax, [rsp + 0x38]
lea ebx, [rdi + 1]
cmovl ecx, edi
lea rdx, str.SoftwarePoliciesMicrosoftWindowsMediaCenter
mov r9d, ebx
mov dword [rsp + 0x60], ecx
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x140024a23
lea rax, [rsp + 0x38]
lea rdx, str.SoftwarePoliciesMicrosoftWindowsMediaCenter
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x140024a75
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareclientsMediaWindows_Media_CenterInstallInfo
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x140015d76
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.IconsVisible
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x78]
cmp eax, edi
cmovne ecx, ebx
mov dword [rsp + 0x78], ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x60], edi
je 0x140024ac7
cmp dword [rsp + 0x68], edi
jne 0x140024ac7
cmp dword [rsp + 0x70], edi
jne 0x140024ac7
cmp dword [rsp + 0x78], edi
je 0x140024ac7
mov eax, ebx
add rsp, 0x48
pop rdi
pop rbx
ret
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.MediaCenter
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x68]
cmp eax, edi
cmovne ecx, edi
mov dword [rsp + 0x68], ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140015cce
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.MediaCenter
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
cmp eax, edi
cmovne edx, edi
mov dword [rsp + 0x70], edx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140015cfe
mov ebx, edi
jmp 0x140015d9e
Function at 0x1400256f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
xor ebp, ebp
xor r9d, r9d
lea edx, [rbp + 0x64]
xor r8d, r8d
mov rdi, rcx
call qword [rax + 0x40]
mov ebx, eax
test eax, eax
jns 0x140025739
cmp eax, 0x80020009
je 0x140025739
lea rdx, str.CRecvrServiceModule::UnregisterServer:_Failed_to_UpdateRegistryFromResource_0x_x
lea ecx, [rbp + 1]
mov r8d, eax
call fcn.140001110
mov ebp, ebx
mov rcx, rdi
call fcn.140025d30
mov ebx, eax
test eax, eax
jns 0x14002575d
lea rdx, str.CRecvrServiceModule::UnregisterServer:_Failed_to_Uninstall_0x_x
mov r8d, eax
mov ecx, 1
call fcn.140001110
mov ebp, ebx
mov rdi, qword [rdi + 0x48]
test rdi, rdi
je 0x140025794
jmp 0x14002578e
call qword [rdi + 0x38]
mov rcx, qword [rdi]
xor r8d, r8d
mov rdx, rax
call fcn.140027e10
mov ebx, eax
test eax, eax
js 0x1400257f8
xor ecx, ecx
call qword [rdi + 8]
mov ebx, eax
test eax, eax
js 0x1400257f8
add rdi, 0x48
cmp qword [rdi], 0
jne 0x140025768
mov rax, qword [0x1400a55e0]
test rax, rax
je 0x1400257a8
call rax
mov ebx, eax
test eax, eax
js 0x1400257f4
mov rdi, qword [0x1400a4710]
mov rax, qword [0x1400a4718]
xor ebx, ebx
jmp 0x1400257ef
mov rsi, qword [rdi]
test rsi, rsi
je 0x1400257eb
call qword [rsi + 0x38]
mov rcx, qword [rsi]
xor r8d, r8d
mov rdx, rax
call fcn.140027e10
mov ebx, eax
test eax, eax
js 0x1400257f4
xor ecx, ecx
call qword [rsi + 8]
mov ebx, eax
test eax, eax
js 0x1400257f4
mov rax, qword [0x1400a4718]
add rdi, 8
cmp rdi, rax
jb 0x1400257ba
test ebx, ebx
jns 0x14002580e
lea rdx, str.CRecvrServiceModule::UnregisterServer:_Failed_to_UnregisterServer_0x_x
mov r8d, ebx
mov ecx, 1
call fcn.140001110
mov ebp, ebx
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogMedia_CenterehRecvr
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14002584e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecvrServiceModule::UnregisterServer:_Failed_to_UpdateRegistryFromResource_0x_x
mov ecx, 1
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov r8d, ebp
call fcn.140001110
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140025d30
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
call fcn.14002586c
test eax, eax
je 0x140025e60
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140025d96
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecvrServiceModule::Uninstall:_Failed_to_OpenSCManager_0x_x
movzx ebx, ax
mov ecx, 1
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.140001110
jmp 0x140025e5e
lea rdx, [rdi + 0x88]
mov r8d, 0x10020
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140025dcc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecvrServiceModule::Uninstall:_Failed_to_OpenService_0x_x
jmp 0x140025d76
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140025e17
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x426
je 0x140025e15
lea rdx, str.CRecvrServiceModule::Uninstall:_Failed_to_Stop_Service_0x_x
mov r8d, ebx
mov ecx, 1
call fcn.140001110
jmp 0x140025e17
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140025e4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecvrServiceModule::Uninstall:_Failed_to_DeleteService_0x_x
mov ecx, 1
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.140001110
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret