joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141d90058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141d901df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141d90089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d9006f
add dl, dl
jne 0x141d90096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d900f6
xor eax, eax
add dl, dl
jne 0x141d900a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d901ad
add dl, dl
jne 0x141d900b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d900c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d900d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d900dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141d900ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141d9007e
mov eax, 1
add dl, dl
jne 0x141d90106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d90113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d900fb
sub eax, ebx
mov ebx, 1
jne 0x141d9014c
mov ecx, 1
add dl, dl
jne 0x141d9012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141d9013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d90123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d9007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141d90168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141d90175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d9015d
cmp eax, 0x7d00
jae 0x141d9019b
cmp eax, 0x500
jb 0x141d90196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d9007e
cmp eax, 0x7f
ja 0x141d9019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d9007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141d901d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141d9007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400017a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400017f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400017f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400017f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400017f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400017f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400017f4
xor al, al
add rsp, 0x28
ret

Function at 0x140005a98
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000588c
Function at 0x14000851c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400085a3
mov rsi, rbx
cmp word [rax], bp
je 0x140008562
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000854c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140008548
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400093b4
mov rdi, rax
test rax, rax
je 0x140008590
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140004780
mov rbp, rdi
xor ecx, ecx
call fcn.14000725c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e180
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000e1a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000e1a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001180
Capabilities:
Get disk information

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x480
mov rax, qword [0x1400208c0]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rax, [rsp + 0x260]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x38], 0x105
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0x105
lea rdx, [rsp + 0x260]
lea rcx, [0x1400189b0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140001247
mov r8d, 0x104
mov rdx, qword [rsp + 0x490]
mov ecx, dword [rsp + 0x40]
call fcn.1400014f0
mov rcx, qword [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x1400012a2
call fcn.1400012e0
cmp eax, 1
je 0x14000126e
cmp dword [rsp + 0x4a0], 0
je 0x140001289
lea r8, str.thsnYaVieBoda
mov edx, 0x104
mov rcx, qword [rsp + 0x490]
call fcn.140001850
jmp 0x1400012a2
lea r8, str.TsnIorcAeBoda
mov edx, 0x104
mov rcx, qword [rsp + 0x490]
call fcn.140001850
cmp qword [rsp + 0x498], 0
je 0x1400012c7
mov r8, qword [rsp + 0x498]
mov edx, 0x104
mov rcx, qword [rsp + 0x490]
call fcn.140001850
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140015df0
add rsp, 0x480
pop rdi
ret

Function at 0x1400012e0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
sub rsp, 0x38
lea r8, str.GlobalARM_Update_Mutex
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140001312
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001327
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jne 0x140001327
xor eax, eax
jmp 0x14000132c
mov eax, 1
add rsp, 0x38
ret

Function at 0x140001340
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
sub rsp, 0x38
lea r8, str.GlobalAcro_Update_Mutex
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140001372
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001381
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140001381
xor eax, eax
jmp 0x140001386
mov eax, 1
add rsp, 0x38
ret
Function at 0x140001580
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x190000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000160a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1400015f5
mov dword [rsp + 0x50], 0xd
jmp 0x1400015fd
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x40], eax
jmp 0x140001761
mov dword [rsp + 0x64], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x64]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x14000165c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140001647
mov dword [rsp + 0x54], 0xd
jmp 0x14000164f
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x40], eax
jmp 0x140001756
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, 4
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400016bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1400016aa
mov dword [rsp + 0x58], 0xd
jmp 0x1400016b2
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x40], eax
jmp 0x140001756
cmp dword [rsp + 0x90], 0
je 0x140001756
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x48]
call fcn.140001770
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140001756
mov dword [rsp + 0x44], 0
mov eax, 1
imul rax, rax, 0
mov eax, dword [rsp + rax + 0x5c]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x88]
inc eax
cmp dword [rsp + 0x44], eax
jne 0x14000172a
mov dword [rsp + 0x40], 0
jmp 0x140001732
mov dword [rsp + 0x40], 0xd
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, 4
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
add rsp, 0x70
pop rdi
ret
Function at 0x140001770
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0xe8
mov dword [rsp + 0x34], 0
jmp 0x1400017a5
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x34], 0xa
jge 0x14000183c
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8d, 4
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001819
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400017fb
mov dword [rsp + 0x38], 0xd
jmp 0x140001803
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xe8
je 0x140001817
jmp 0x14000183c
jmp 0x140001837
mov eax, dword [rsp + 0x3c]
cmp rax, 4
jne 0x14000182d
mov dword [rsp + 0x30], 0
jmp 0x140001835
mov dword [rsp + 0x30], 0xd
jmp 0x14000183c
jmp 0x140001790
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140008580
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x14000858e
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x10], 0
je 0x1400085ca
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x38]
call fcn.14000d850
jmp 0x140008669
movzx eax, byte [0x140021ee0]
test eax, eax
jne 0x14000860f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140008608
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140021ed8], rax
mov byte [0x140021ee0], 1
cmp qword [0x140021ed8], 0
je 0x140008655
mov rax, qword [0x140021ed8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax + 8]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x48]
call qword [0x1400185f8]
jmp 0x140008669
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
add rsp, 0x58
ret

Function at 0x140008670
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x14000867e
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
add rsp, 0x28
ret
Function at 0x14000b3a0
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2a8
mov rax, qword [0x1400208c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x2b0]
call fcn.14000bc70
test eax, eax
je 0x14000b3d9
mov eax, 1
jmp 0x14000b510
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x14000b41e
mov rax, qword [rsp + 0x2b0]
add rax, 0x50
xor r9d, r9d
mov r8, rax
lea rdx, str.Couldnt_open_service_manager
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14000b510
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x2b0]
add rax, 0x50
mov rcx, qword [rsp + 0x2b0]
add rcx, 0x50
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea rdx, str.RPCSS
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x14000b4f5
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, qword [rsp + 0x2b0]
add rax, 0x50
xor r9d, r9d
mov r8, rax
lea rdx, str.Couldnt_create_service
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14000b510
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140015df0
add rsp, 0x2a8
ret
Function at 0x14000b950
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x290
mov rax, qword [0x1400208c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov dword [rsp + 0x30], 1
lea rdx, str.InstallPath
lea rcx, str.SoftwareAdobeAcrobat_Distiller_
call fcn.140001ba0
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000bac5
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x208
mov dword [rsp + 0x44], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
test rax, rax
je 0x14000bac5
lea rdx, str.Adist64.dll
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea rcx, [rsp + 0x70]
call fcn.140012470
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000bac5
lea rdx, str.IsAcrobatProInstalled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000ba71
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
call qword [0x1400185f8]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000ba82
mov dword [rsp + 0x30], 0
jmp 0x14000baba
lea rdx, str.IsAcrobatElementsInstalled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14000baba
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
call qword [0x1400185f8]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140015df0
add rsp, 0x290
pop rdi
ret
Function at 0x14000c240
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x288
mov rax, qword [0x1400208c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x70]
call fcn.140012060
mov qword [rsp + 0x58], 0
mov eax, 8
imul rax, rax, 0
lea rcx, [rsp + 0x70]
mov qword [rsp + rax + 0x60], rcx
mov rax, qword [rsp + 0x290]
cmp dword [rax + 0x278], 0
je 0x14000c338
mov rax, qword [rsp + 0x290]
add rax, 0x50
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000c336
mov eax, 8
imul rax, rax, 0
lea rax, [rsp + rax + 0x60]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov dx, 4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x14000c343
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140015df0
add rsp, 0x288
ret

Function at 0x14000d450
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x14000d468
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shl rax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14000d4ca
mov eax, dword [rsp + 0x34]
jmp 0x14000d554
cmp dword [rsp + 0x38], 1
je 0x14000d4df
cmp dword [rsp + 0x38], 2
je 0x14000d4df
mov eax, 0xd
jmp 0x14000d554
cmp qword [rsp + 0x60], 0
je 0x14000d53d
cmp dword [rsp + 0x30], 0
je 0x14000d529
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
test rax, rax
jne 0x14000d520
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x60]
movzx eax, word [rcx + rax*2 - 2]
test eax, eax
je 0x14000d527
mov eax, 0xd
jmp 0x14000d554
jmp 0x14000d53d
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rsp + 0x60]
mov word [rdx + rax], cx
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000d560
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x1400208c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140002f60
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x58]
call fcn.14000c9e0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x14000d5e5
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x58]
call fcn.140003b60
mov eax, dword [rsp + 0x48]
jmp 0x14000d6a3
mov dword [rsp + 0x44], 0x100
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000d672
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.14000d560
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x14000d665
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x58]
call fcn.140003b60
mov eax, dword [rsp + 0x4c]
jmp 0x14000d6a3
mov dword [rsp + 0x44], 0x100
jmp 0x14000d5ed
lea rcx, [rsp + 0x58]
call fcn.1400077a0
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.140008580
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x58]
call fcn.140003b60
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140015df0
add rsp, 0x298
ret

Function at 0x14000d850
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x14000d901
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14000d896
mov eax, 1
jmp 0x14000d926
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000d8ff
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x58]
call qword [0x1400185f8]
jmp 0x14000d926
jmp 0x14000d921
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 0
je 0x14000d921
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000d926
mov eax, 1
add rsp, 0x68
ret