joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ada0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x44], 0x20019
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x10001ae0a
xor eax, eax
jmp 0x10001ae66
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x10001ae4b
mov dword [rsp + 0x4c], 0
jmp 0x10001ae53
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x4c]
add rsp, 0x68
ret

Function at 0x10001ae80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x3c], 0x208
mov dword [rsp + 0x38], 0x20019
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x10001af2a
call fcn.1000192d0
test rax, rax
je 0x10001af20
call fcn.1000192d0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x20], ecx
lea r9, [0x100016630]
mov r8d, 0xc0
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov eax, 0xffffffff
jmp 0x10001afed
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xea
jne 0x10001af6c
mov dword [rsp + 0x44], 0xffffffff
jmp 0x10001af8c
cmp dword [rsp + 0x40], 2
jne 0x10001af7d
mov dword [rsp + 0x44], 0xffffffff
jmp 0x10001af8c
cmp dword [rsp + 0x40], 0
je 0x10001af8c
mov dword [rsp + 0x44], 0xffffffff
call fcn.1000192d0
test rax, rax
je 0x10001afda
mov rcx, qword [rsp + 0x70]
call fcn.1000234a4
mov qword [rsp + 0x48], rax
call fcn.1000192d0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [0x100016680]
mov r8d, 0xcc
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x44]
add rsp, 0x58
ret
Function at 0x10001b000
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0xf003f
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
je 0x10001b0c8
call fcn.1000192d0
test rax, rax
je 0x10001b0be
call fcn.1000192d0
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x5c]
mov dword [rsp + 0x20], ecx
lea r9, [0x1000166c0]
mov r8d, 0xdf
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov eax, 0xffffffff
jmp 0x10001b18c
call fcn.1000192d0
test rax, rax
je 0x10001b11c
mov rcx, qword [rsp + 0x90]
call fcn.1000234a4
mov qword [rsp + 0x68], rax
call fcn.1000192d0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rcx
lea r9, [0x100016710]
mov r8d, 0xe3
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov rcx, qword [rsp + 0x90]
call fcn.1000234a4
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
je 0x10001b16e
mov dword [rsp + 0x60], 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x60]
add rsp, 0x78
ret

Function at 0x10001b290
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x1000355a0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x118
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10001b2f7
cmp dword [rsp + 0x34], 5
ja 0x10001b2f0
cmp dword [rsp + 0x34], 5
jne 0x10001b2f7
cmp dword [rsp + 0x38], 0
jbe 0x10001b2f7
mov eax, 1
jmp 0x10001b2f9
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.100023280
add rsp, 0x160
pop rdi
ret

Function at 0x10001b320
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x1000355a0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x118
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10001b380
cmp dword [rsp + 0x34], 5
jne 0x10001b380
cmp dword [rsp + 0x38], 1
jne 0x10001b380
mov eax, 1
jmp 0x10001b382
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.100023280
add rsp, 0x160
pop rdi
ret
Function at 0x10001b6d0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov dword [rsp + 0x68], 0x80004005
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x10001b7da
mov eax, dword [rsp + 0x40]
and eax, 0xfffffff8
mov dword [rsp + 0x6c], eax
mov r9d, dword [rsp + 0x6c]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x80]
lea rcx, [0x1000167a0]
call fcn.100023520
call fcn.1000192d0
test rax, rax
je 0x10001b789
call fcn.1000192d0
mov ecx, dword [rsp + 0x6c]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rcx
lea r9, [0x1000167d0]
mov r8d, 0x1b3
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov edx, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10001b7da
lea rcx, [0x100016820]
call fcn.100023520
call fcn.1000192d0
test rax, rax
je 0x10001b7d6
call fcn.1000192d0
lea r9, [0x100016850]
mov r8d, 0x1b7
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
xor eax, eax
jmp 0x10001b82b
mov rdx, qword [rsp + 0x80]
lea rcx, [0x1000168a0]
call fcn.100023520
call fcn.1000192d0
test rax, rax
je 0x10001b826
call fcn.1000192d0
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rcx
lea r9, [0x1000168d0]
mov r8d, 0x1bc
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov eax, 0x80004005
add rsp, 0x70
pop rdi
ret
Function at 0x10001c280
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x510
mov qword [rsp + 0x500], 0xfffffffffffffffe
mov rax, qword [0x1000355a0]
xor rax, rsp
mov qword [rsp + 0x508], rax
mov dword [rsp + 0x2ac], 0
mov qword [rsp + 0x2a0], 0
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 0x24c
rep stosb byte [rdi], al
mov word [rsp + 0x2b0], 0
lea rax, [rsp + 0x2b2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x2a8], 0
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10001c4a4
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x4c0]
call fcn.10001c910
nop
lea rdx, [0x1000169c0]
lea rcx, [rsp + 0x4c0]
call fcn.10001c9a0
lea rdx, [0x100016c48]
lea rcx, [rsp + 0x4c0]
call fcn.10001c9a0
lea rcx, [rsp + 0x4c0]
call fcn.10001ca70
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x2a0], rax
cmp qword [rsp + 0x2a0], 0xffffffffffffffff
jne 0x10001c460
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x4e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, dword [rsp + 0x2a8]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.1000192d0
test rax, rax
je 0x10001c418
call fcn.1000192d0
mov ecx, dword [rsp + 0x2a8]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x4e8]
mov qword [rsp + 0x20], rcx
lea r9, [0x100016c60]
mov r8d, 0x2bc
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov rcx, qword [rsp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x2a8]
call fcn.10001a920
mov dword [rsp + 0x2ac], eax
mov eax, dword [rsp + 0x2ac]
mov dword [rsp + 0x4f8], eax
lea rcx, [rsp + 0x4c0]
call fcn.10001c970
mov eax, dword [rsp + 0x4f8]
jmp 0x10001c55e
mov rax, qword [rsp + 0x520]
mov rax, qword [rax]
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsp + 0x520]
call qword [rax + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10001c460
lea rcx, [rsp + 0x4c0]
call fcn.10001c970
jmp 0x10001c557
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, dword [rsp + 0x2a8]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.1000192d0
test rax, rax
je 0x10001c52d
call fcn.1000192d0
mov ecx, dword [rsp + 0x2a8]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x4f0]
mov qword [rsp + 0x20], rcx
lea r9, [0x100016cb0]
mov r8d, 0x2d5
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x2a8]
call fcn.10001a920
mov dword [rsp + 0x2ac], eax
mov eax, dword [rsp + 0x2ac]
jmp 0x10001c55e
mov eax, dword [rsp + 0x2ac]
mov rcx, qword [rsp + 0x508]
xor rcx, rsp
call fcn.100023280
add rsp, 0x510
pop rdi
ret
Function at 0x10001c5d0
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x500
mov qword [rsp + 0x4d8], 0xfffffffffffffffe
mov rax, qword [0x1000355a0]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov dword [rsp + 0x29c], 0
mov qword [rsp + 0x290], 0
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x24c
rep stosb byte [rdi], al
mov word [rsp + 0x2a0], 0
lea rax, [rsp + 0x2a2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x298], 0
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10001c7e2
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4b0]
call fcn.10001c910
nop
lea rdx, [0x1000169c0]
lea rcx, [rsp + 0x4b0]
call fcn.10001c9a0
lea rdx, [0x100016d08]
lea rcx, [rsp + 0x4b0]
call fcn.10001c9a0
lea rcx, [rsp + 0x4b0]
call fcn.10001ca70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10001c769
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x298], eax
lea rcx, [rsp + 0x4b0]
call fcn.10001ca70
mov r8d, dword [rsp + 0x298]
mov rdx, rax
lea rcx, [0x100016a18]
call fcn.100023520
call fcn.1000192d0
test rax, rax
je 0x10001c754
lea rcx, [rsp + 0x4b0]
call fcn.10001ca70
mov qword [rsp + 0x4e0], rax
call fcn.1000192d0
mov ecx, dword [rsp + 0x298]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x4e0]
mov qword [rsp + 0x20], rcx
lea r9, [0x100016d20]
mov r8d, 0x2f6
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov ecx, dword [rsp + 0x298]
call fcn.10001a920
mov dword [rsp + 0x29c], eax
jmp 0x10001c7d3
lea rcx, [rsp + 0x4b0]
call fcn.10001ca70
mov rdx, rax
lea rcx, [0x100016d60]
call fcn.100023520
call fcn.1000192d0
test rax, rax
je 0x10001c7d3
lea rcx, [rsp + 0x4b0]
call fcn.10001ca70
mov qword [rsp + 0x4e8], rax
call fcn.1000192d0
mov rcx, qword [rsp + 0x4e8]
mov qword [rsp + 0x20], rcx
lea r9, [0x100016d80]
mov r8d, 0x2fa
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
nop
lea rcx, [rsp + 0x4b0]
call fcn.10001c970
jmp 0x10001c841
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x298], eax
call fcn.1000192d0
test rax, rax
je 0x10001c825
call fcn.1000192d0
mov ecx, dword [rsp + 0x298]
mov dword [rsp + 0x20], ecx
lea r9, [0x100016dc0]
mov r8d, 0x2ff
lea rdx, [0x1000165b0]
mov rcx, rax
call fcn.100019380
mov ecx, dword [rsp + 0x298]
call fcn.10001a920
mov dword [rsp + 0x29c], eax
mov eax, dword [rsp + 0x29c]
jmp 0x10001c848
mov eax, dword [rsp + 0x29c]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.100023280
add rsp, 0x500
pop rdi
ret
Function at 0x10001eeb0
Capabilities:
Query service status

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x1000355a0]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x40]
lea rcx, [0x1000171a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x30], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x10001ef2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1000171b0]
call fcn.100023520
jmp 0x10001efcf
mov r8d, 0xf01ff
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x10001ef71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1000171d0]
call fcn.100023520
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001efcf
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10001efad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1000171f0]
call fcn.100023520
jmp 0x10001efb9
lea rcx, [0x100017218]
call fcn.100023520
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.100023280
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x1000206b0
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rax, qword [0x1000355a0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x290]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x288]
mov r8, qword [rsp + 0x280]
lea rdx, [0x100017fb8]
mov rcx, qword [rsp + 0x270]
call qword [rax + 0x10]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x20010001
jne 0x100020759
call fcn.1000192d0
test rax, rax
je 0x100020751
call fcn.1000192d0
lea r9, [0x100017fd0]
mov r8d, 0x1a5
lea rdx, [0x100017a10]
mov rcx, rax
call fcn.100019380
mov dword [rsp + 0x30], 0xa0010400
cmp dword [rsp + 0x30], 0
jge 0x100020769
mov eax, dword [rsp + 0x30]
jmp 0x10002089f
mov rax, qword [rsp + 0x270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x290]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x288]
mov r8, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x270]
call qword [rax + 0x50]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xa0010100
jne 0x10002089b
call fcn.10001b320
test eax, eax
je 0x10002089b
mov word [rsp + 0x40], 0
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov edx, 0x103
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x40]
call fcn.1000234a4
mov ecx, 0x104
sub rcx, rax
mov rax, rcx
sub rax, 1
mov r8, rax
lea rdx, [0x100018068]
lea rcx, [rsp + 0x40]
call fcn.100024138
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10002089b
call fcn.1000192d0
test rax, rax
je 0x10002085c
call fcn.1000192d0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [0x100018088]
mov r8d, 0x1c2
lea rdx, [0x100017a10]
mov rcx, rax
call fcn.100019380
mov rax, qword [rsp + 0x270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x290]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x288]
mov r8, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x270]
call qword [rax + 0x50]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.100023280
add rsp, 0x260
pop rdi
ret
Function at 0x100020db0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x290
mov rax, qword [0x1000355a0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov word [rsp + 0x60], 0
lea rax, [rsp + 0x62]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x100020e17
mov eax, 1
jmp 0x100020ff9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x100020e65
cmp dword [rsp + 0x50], 2
jne 0x100020e5e
mov eax, 1
jmp 0x100020ff9
xor eax, eax
jmp 0x100020ff9
mov rcx, qword [rsp + 0x2a8]
call fcn.1000234a4
mov rcx, qword [rsp + 0x2a8]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
movzx eax, word [rax - 2]
cmp eax, 0x5c
je 0x100020ec5
mov rax, qword [rsp + 0x278]
mov word [rax], 0x5c
mov rax, qword [rsp + 0x278]
add rax, 2
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov word [rax], 0
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x270]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x100020fa3
lea r8, [rsp + 0x60]
mov edx, 0x208
mov rcx, qword [rsp + 0x278]
call fcn.100020b10
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.100020db0
test eax, eax
jne 0x100020f4d
jmp 0x100020fa3
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x270]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x100020f1b
mov rax, qword [rsp + 0x278]
sub rax, 2
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov word [rax], 0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x100020ff7
mov eax, 1
jmp 0x100020ff9
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.100023280
add rsp, 0x290
pop rdi
ret
Function at 0x1000210f0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov r8d, 0x80000000
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x100021121
mov eax, 0xffffffff
jmp 0x100021201
mov r8d, 0x80000000
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x100021159
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0xffffffff
jmp 0x100021201
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x3c]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1000211a3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0xffffffff
jmp 0x100021201
cmp dword [rsp + 0x3c], 4
jne 0x1000211b4
mov dword [rsp + 0x58], 1
jmp 0x1000211bc
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rsp + 0x30], 0
je 0x1000211f5
mov dword [rsp + 0x5c], 1
jmp 0x1000211fd
mov dword [rsp + 0x5c], 0
mov eax, dword [rsp + 0x5c]
add rsp, 0x60
pop rdi
ret
Function at 0x100021210
Capabilities:
Query service status

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
xor eax, eax
cmp eax, 1
je 0x100021338
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x100021270
jmp 0x100021338
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
cmp dword [rax + 4], ecx
jne 0x100021283
jmp 0x100021338
cmp dword [rsp + 0x68], 0xffffffff
je 0x1000212ae
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rsp + 0x30], eax
jae 0x1000212ae
mov ecx, 0x5b4
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x20], 1
jmp 0x100021338
cmp dword [rsp + 0x28], 0
je 0x1000212d7
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], 0
jmp 0x100021325
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
cmp dword [rsp + 0x2c], eax
je 0x1000212ff
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x24], eax
jmp 0x100021325
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x24]
cmp dword [rax + 0x14], ecx
jbe 0x10002131b
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x24], eax
jmp 0x100021325
mov dword [rsp + 0x20], 1
jmp 0x100021338
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100021245
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret