joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e1e10
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
or qword [rsp + 0x58], 0xffffffffffffffff
lea rdx, [rsp + 0x50]
mov rdi, rcx
mov rcx, qword [rcx + 0x68]
call fcn.1400c23f8
mov ebx, eax
test eax, eax
jns 0x1400e1e3e
mov ecx, eax
jmp 0x1400e1ec9
cmp dword [rsp + 0x50], 0
je 0x1400e1ece
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rdi + 0x68]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14003bd88
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x1400e1e9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de7c
mov ebx, eax
jmp 0x1400e1e37
lea rcx, [rsp + 0x58]
call fcn.140039774
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400e1e8a
cmp qword [rsp + 0x60], 0x200000
jle 0x1400e1ece
mov ebx, 0x8007000d
mov ecx, ebx
call fcn.14003e600
mov ecx, ebx
call fcn.14006a86c
lea rcx, [rsp + 0x58]
call fcn.1402c23fc
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400e21f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e2220
test al, 0x10
je 0x1400e2217
xor eax, eax
test ebx, ebx
setne al
jmp 0x1400e2222
xor eax, eax
test ebx, ebx
sete al
jmp 0x1400e2222
xor eax, eax
mov dword [rdi], eax
xor ecx, ecx
call fcn.14006a86c
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400f4f10
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, r9
lea r9, [rax - 0x18]
mov qword [rax - 0x18], rdi
mov rcx, 0xffffffff80000001
lea r8d, [rdi + 1]
call fcn.14003a0bc
mov dword [rsp + 0x60], eax
mov ebx, eax
test eax, eax
jns 0x1400f4f58
mov ecx, eax
call fcn.14003e600
jmp 0x1400f4fa9
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.State
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400f4fa2
cmp eax, 2
je 0x1400f4fa7
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14003dfe4
mov ebx, dword [rsp + 0x60]
test eax, eax
jne 0x1400f4fa7
mov ecx, ebx
jmp 0x1400f4f51
mov edi, 1
mov dword [rsi], edi
mov ecx, ebx
call fcn.14006a86c
lea rcx, [rsp + 0x30]
call fcn.14003b9a8
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400f5540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor eax, eax
lea r9, [rbp + 0x48]
and qword [rbp - 0x10], rax
mov rsi, rdx
and qword [rsp + 0x20], rax
lea rdx, [rbp + 0x40]
mov rdi, rcx
mov dword [rbp + 0x40], eax
xor r12d, r12d
lea r8d, [rax + 4]
mov rcx, rsi
mov qword [rbp - 0x18], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400f55a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de7c
mov ebx, eax
mov ecx, eax
call fcn.14003e600
jmp 0x1400f562a
cmp dword [rbp + 0x48], 4
je 0x1400f55b7
mov ecx, 0x8007000d
mov ebx, ecx
jmp 0x1400f559e
mov eax, dword [rbp + 0x40]
sub eax, 1
je 0x1400f55f1
cmp eax, 1
jne 0x1400f55ae
lea rax, [rbp - 0x20]
mov rdx, rsi
lea r9, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x1c]
call fcn.1400f8788
mov ebx, eax
test eax, eax
js 0x1400f559c
mov r12, qword [rbp - 0x18]
mov r14d, dword [rbp - 0x20]
mov r15d, dword [rbp - 0x1c]
jmp 0x1400f5608
mov rdx, rsi
call fcn.1400f869c
mov ebx, eax
test eax, eax
js 0x1400f559c
mov r14d, 1
xor r15d, r15d
and qword [rbp - 0x18], 0
lea rcx, [rdi + 0x18]
mov rdx, r12
mov qword [rdi + 8], rsi
call fcn.14003bcf0
mov eax, dword [rbp + 0x40]
mov dword [rdi], eax
mov dword [rdi + 0x20], r15d
mov dword [rdi + 0x10], r14d
mov ecx, ebx
call fcn.14006a86c
lea rcx, [rbp - 0x18]
call fcn.14003b618
lea rcx, [rbp - 0x10]
call fcn.14019c76c
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400f869c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x40]
mov rbx, rdx
call fcn.1400ee8fc
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 0x78
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400f86fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de7c
mov ebx, eax
mov ecx, eax
jmp 0x1400f875a
cmp dword [rsp + 0x30], 0x78
je 0x1400f8708
mov ebx, 0x8007000d
jmp 0x1400f8758
mov r8d, 0x3c
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.14007b650
mov ebx, eax
test eax, eax
js 0x1400f86f6
lea rdx, str.spp:migblob_aesencryptor_tokenact
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400f875f
and qword [rsp + 0x20], 0
mov ecx, 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc00004a5
call fcn.14006a49c
mov ebx, 0x80049e59
mov ecx, ebx
call fcn.14003e600
mov ecx, ebx
call fcn.14006a86c
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001af10
add rsp, 0xd0
pop rbx
ret
Function at 0x14010c410
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r15, rcx
mov r14, r8
lea rcx, [rsp + 0x68]
mov rsi, rdx
call fcn.14001a658
lea rcx, [rbp - 0x80]
call fcn.140109a50
mov rdx, qword [r15 + 8]
lea rax, [rsp + 0x58]
and qword [rsp + 0x58], 0
mov r9d, 8
and qword [rsp + 0x48], 0
xor r8d, r8d
and qword [rsp + 0x50], 0
mov rcx, 0xffffffff80000002
and dword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x14010c49e
xor ebx, ebx
jmp 0x14010c643
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.14003dfe4
mov ebx, dword [rsp + 0x40]
test eax, eax
jne 0x14010c4be
mov ecx, ebx
call fcn.14003e600
jmp 0x14010c643
xor edi, edi
lea r13d, [rdi + 1]
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x64]
and qword [rsp + 0x30], 0
lea r8, [rbp - 0x30]
and qword [rsp + 0x28], 0
mov edx, edi
mov rcx, qword [rsp + 0x58]
and qword [rsp + 0x20], 0
mov dword [rsp + 0x64], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add edi, r13d
cmp eax, 0x103
je 0x14010c636
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.14003dfe4
test eax, eax
je 0x14010c62d
lea rcx, [rsp + 0x48]
call fcn.14003be08
mov rcx, qword [r15 + 8]
lea r9, [rsp + 0x48]
lea rdx, [rbp - 0x30]
call fcn.1400ba304
mov dword [rsp + 0x40], eax
mov ebx, eax
test eax, eax
js 0x14010c61a
lea rcx, [rsp + 0x50]
call fcn.14003be08
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x50]
lea r8, [0x140361c9c]
mov rcx, 0xffffffff80000002
call fcn.140068110
test eax, eax
js 0x14010c621
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14010c4c4
lea rcx, [rbp - 0x38]
call fcn.14003be08
lea rcx, [rbp - 0x80]
call fcn.14003be08
lea rdx, [rbp - 0x38]
mov rcx, rsi
call fcn.14003f3c8
mov ebx, eax
test eax, eax
js 0x14010c61a
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x30]
call fcn.14003f3c8
mov ebx, eax
test eax, eax
js 0x14010c61a
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x60]
and dword [rbp - 0x44], 0
lea r8, [0x140361c84]
mov rcx, 0xffffffff80000002
call fcn.1400680fc
test eax, eax
js 0x14010c5fb
mov ecx, dword [rsp + 0x60]
cmp ecx, r13d
ja 0x14010c621
xor eax, eax
test ecx, ecx
cmovne eax, r13d
mov dword [rbp - 0x44], eax
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.14010d850
mov dword [rsp + 0x40], eax
mov ebx, eax
test eax, eax
jns 0x14010c4c4
mov ecx, eax
jmp 0x14010c4b4
mov ecx, 0x8004f807
mov ebx, ecx
jmp 0x14010c4b4
mov ebx, dword [rsp + 0x40]
jmp 0x14010c4b2
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.140109dd0
mov ecx, ebx
call fcn.14006a86c
lea rcx, [rsp + 0x50]
call fcn.14003b968
lea rcx, [rsp + 0x48]
call fcn.14003b968
lea rcx, [rsp + 0x58]
call fcn.14003b9a8
lea rcx, [rbp - 0x80]
call fcn.140109d38
lea rcx, [rsp + 0x68]
call fcn.140109bd0
mov eax, ebx
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14001af10
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14010c6a4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rcx
mov r14, rdx
lea rcx, [rbp - 0x61]
call fcn.14001a658
lea rcx, [rbp - 0x51]
call fcn.140109a1c
mov rdx, qword [rsi]
lea rax, [rbp - 0x71]
and qword [rbp - 0x71], 0
mov r9d, 8
and qword [rbp - 0x69], 0
xor r8d, r8d
and dword [rbp - 0x79], 0
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x14010c720
xor ebx, ebx
jmp 0x14010c7f1
lea rdx, [rbp - 0x79]
mov ecx, eax
call fcn.14003dfe4
mov ebx, dword [rbp - 0x79]
test eax, eax
jne 0x14010c73e
mov ecx, ebx
call fcn.14003e600
jmp 0x14010c7f1
xor edi, edi
and qword [rsp + 0x38], 0
lea r9, [rbp - 0x75]
and qword [rsp + 0x30], 0
lea r8, [rbp - 0x19]
and qword [rsp + 0x28], 0
mov edx, edi
mov rcx, qword [rbp - 0x71]
and qword [rsp + 0x20], 0
mov dword [rbp - 0x75], 0x25
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc edi
cmp eax, 0x103
je 0x14010c7e5
lea rdx, [rbp - 0x79]
mov ecx, eax
call fcn.14003dfe4
test eax, eax
je 0x14010c7dd
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.1400687bc
test eax, eax
js 0x14010c7d3
lea r8, [rbp - 0x51]
mov rcx, rsi
lea rdx, [rbp - 0x19]
call fcn.14010cba0
mov ebx, eax
test eax, eax
js 0x14010c7cc
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x61]
call fcn.14010d7e8
mov dword [rbp - 0x79], eax
mov ebx, eax
test eax, eax
jns 0x14010c740
mov ecx, eax
jmp 0x14010c734
mov ebx, 0x8004f807
jmp 0x14010c732
mov ebx, dword [rbp - 0x79]
jmp 0x14010c732
lea rdx, [rbp - 0x61]
mov rcx, r14
call fcn.140109db0
mov ecx, ebx
call fcn.14006a86c
lea rcx, [rbp - 0x69]
call fcn.14003b968
lea rcx, [rbp - 0x71]
call fcn.14003b9a8
lea rcx, [rbp - 0x51]
call fcn.140109cf8
lea rcx, [rbp - 0x61]
call fcn.140109bc4
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14001af10
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14010da9c
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r12d, r12d
mov word [rbp + 0x2b], 0x500
lea rax, [rbp + 7]
mov qword [rbp + 0x17], r12
mov qword [r11 - 0x68], rax
mov r13, rcx
mov dword [r11 - 0x70], r12d
lea rcx, [rbp + 0x27]
mov dword [r11 - 0x78], r12d
lea r8d, [r12 + 4]
mov dword [r11 - 0x80], r12d
xor r9d, r9d
mov dword [rsp + 0x30], r12d
mov dl, 1
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov qword [rbp + 0x1f], r12
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r12
mov dword [rbp + 0x27], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x14010db43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de7c
mov edi, eax
mov ecx, eax
call fcn.14003e600
jmp 0x14010dc17
lea rax, [rbp + 0xf]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x27]
mov dword [rsp + 0x48], r12d
mov dl, 1
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
lea r8d, [r9 + 6]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14010db28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x17]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14010db28
mov rcx, qword [rbp + 0x17]
lea r8, [rbp + 0x1f]
call fcn.14010918c
mov edi, eax
test eax, eax
js 0x14010db37
mov rbx, qword [rbp + 0x1f]
mov r15d, r12d
mov esi, r12d
mov r14d, r12d
cmp dword [rbx], r12d
jbe 0x14010dc0e
mov rcx, qword [rbp + 7]
mov r12d, r14d
add r12, r12
mov rdx, qword [rbx + r12*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14010dbe3
xor esi, esi
lea r15d, [rsi + 1]
jmp 0x14010dbfd
mov rdx, qword [rbx + r12*8 + 8]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14010dbfd
xor r15d, r15d
lea esi, [r15 + 1]
inc r14d
cmp r14d, dword [rbx]
jb 0x14010dbc2
test esi, esi
jne 0x14010dc13
test r15d, r15d
jne 0x14010dc13
mov esi, 1
mov dword [r13], esi
mov ecx, edi
call fcn.14006a86c
lea rcx, [rbp + 0xf]
call fcn.14003b9c0
lea rcx, [rbp + 7]
call fcn.14003b9c0
lea rcx, [rbp + 0x1f]
call fcn.14019c76c
lea rcx, [rbp + 0x17]
call fcn.1400b65e4
mov eax, edi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001af10
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14010e420
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
or qword [rbp - 0x20], 0xffffffffffffffff
mov r12, rdx
xor edi, edi
lea rdx, [rbp - 0x18]
mov rsi, rcx
mov qword [rbp - 8], rdi
mov rcx, r12
mov qword [rbp - 0x10], rdi
mov r15, r9
mov qword [rbp - 0x18], rdi
mov r13, r8
call fcn.1400617b8
mov ebx, eax
test eax, eax
js 0x14010e5be
mov rcx, qword [rbp - 0x18]
lea r8d, [rdi + 5]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14003bd88
mov rcx, rax
call fcn.140039774
test rax, rax
jne 0x14010e4c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de7c
mov ebx, eax
jmp 0x14010e5be
lea rcx, [rbp - 0x20]
call fcn.140039774
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
je 0x14010e4b4
cmp dword [rbp - 0x30], edi
je 0x14010e4f7
mov ecx, 0x80070057
mov ebx, ecx
jmp 0x14010e5c0
cmp r14d, 0x100000
ja 0x14010e4eb
mov rcx, r14
call fcn.1400392dc
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1401c4984
mov rbx, qword [rbp - 8]
test rbx, rbx
jne 0x14010e529
mov ebx, 0x8007000e
mov ecx, ebx
jmp 0x14010e5c0
lea rcx, [rbp - 0x20]
call fcn.140039774
mov rdx, rbx
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea r9, [rbp - 0x2c]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14010e4b4
cmp dword [rbp - 0x2c], r14d
je 0x14010e55f
mov ebx, 0x8000ffff
jmp 0x14010e522
mov rsi, qword [rsi + 0xb8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [0x1403358c8]
lea rax, [rbp - 0x28]
mov r8d, r14d
lea r9, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rsi
call rdi
mov ebx, eax
test eax, eax
js 0x14010e5be
mov edx, dword [rbp - 0x28]
mov r9, r15
mov rcx, qword [rbp - 0x10]
mov r8, r13
call fcn.14010e618
mov ebx, eax
test eax, eax
js 0x14010e5be
lea rdx, [r15 + 0x20]
mov rcx, r12
call fcn.14003f3c8
mov ebx, eax
test eax, eax
jns 0x14010e5c5
mov ecx, eax
call fcn.14003e600
mov ecx, ebx
call fcn.14006a86c
lea rcx, [rbp - 0x18]
call fcn.14003b968
lea rcx, [rbp - 0x10]
call fcn.14011e52c
lea rcx, [rbp - 8]
call fcn.14019c76c
lea rcx, [rbp - 0x20]
call fcn.1402c23fc
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140120d20
Capabilities:
Query service status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
lea rax, [r11 - 0x48]
xor ebx, ebx
mov qword [r11 - 0x58], rax
lea r8, [r11 - 0x40]
xor edx, edx
lea r9d, [rbx + 0x24]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140120d74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de7c
mov ecx, eax
mov ebx, eax
call fcn.14003e600
jmp 0x140120d8c
movups xmm0, xmmword [rsp + 0x38]
mov eax, dword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
mov dword [rdi + 0x20], eax
mov ecx, ebx
call fcn.14006a86c
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001af10
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x14016fccc
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov eax, dword [r11 + 0x28]
xor ebx, ebx
movzx esi, cx
mov ebp, edx
mov r15d, r9d
lea rdx, [r11 + 0x30]
mov r14, r8
lea ecx, [rbx + 5]
cmp eax, ecx
cmova eax, ecx
mov dword [r11 + 0x28], eax
test eax, eax
je 0x14016fd31
lea rcx, [rdx - 8]
mov r8d, eax
lea rdx, [r11 - 0x68]
lea rcx, [rcx + 8]
mov rax, qword [rcx]
mov qword [rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x14016fd1d
lea rdx, str.Software_Protection_Platform_Service
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
jne 0x14016fd61
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14016fd56
mov ebx, eax
jmp 0x14016fdbd
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14016fdbd
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
movzx eax, word [rsp + 0xe0]
mov r9d, ebp
mov dword [rsp + 0x30], r15d
movzx edx, si
mov word [rsp + 0x28], ax
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x14016fdb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14016fdab
mov ebx, eax
jmp 0x14016fdb4
movzx ebx, ax
or ebx, 0x80070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, ebx
call fcn.14006a86c
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14001af10
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14017138c
Capabilities:
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
push rdi
sub rsp, 0x30
xor edi, edi
lea r8, [rax + 0x20]
mov qword [rax - 0x18], rdi
mov qword [rax + 0x20], rdi
lea edx, [rdi + 0x14]
call fcn.140120c5c
mov edx, eax
mov esi, 0x80070426
test eax, eax
jns 0x1401713c5
mov ecx, eax
jmp 0x140171439
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
call fcn.140171b64
mov edx, eax
test eax, eax
js 0x1401713c1
cmp dword [rsp + 0x50], edi
jne 0x140171449
cmp qword [rsp + 0x20], rdi
lea r8, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov edx, edi
setne dl
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14017141a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x14017141a
mov ecx, eax
call fcn.14003de7c
mov edx, eax
test eax, eax
jns 0x14017143e
jmp 0x1401713c1
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
call fcn.140171b64
mov edx, eax
test eax, eax
js 0x1401713c1
cmp dword [rsp + 0x50], edi
jne 0x14017143e
mov edx, esi
mov ecx, esi
call fcn.14003e600
cmp edx, 0x800705b4
cmove edx, esi
mov edi, edx
mov ecx, edi
call fcn.14006a86c
lea rcx, [rsp + 0x58]
call fcn.14011e588
mov rsi, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14019a0fc
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x40], 0
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, eax
lea rdx, [rsp + 0x40]
call fcn.14003dfe4
test eax, eax
jne 0x14019a124
mov ecx, dword [rsp + 0x40]
call fcn.14003e600
mov ecx, dword [rsp + 0x40]
call fcn.14006a86c
mov eax, dword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x14019af80
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rbp + 0x190], rax
and qword [rsp + 0x68], 0
lea r9, [rsp + 0x68]
mov r8d, 0x2000000
mov qword [rsp + 0x70], rdx
mov rsi, rcx
call fcn.14003a0bc
mov dword [rsp + 0x60], eax
mov edi, eax
test eax, eax
js 0x14019b09b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x58], rdi
xor r8d, r8d
mov qword [rsp + 0x50], rdi
xor edx, edx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.14003dfe4
test eax, eax
jne 0x14019b076
mov edi, dword [rsp + 0x60]
mov ecx, edi
jmp 0x14019b09d
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x80]
dec eax
mov r9d, 0x105
mov edx, eax
mov dword [rsp + 0x64], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.14003dfe4
test eax, eax
je 0x14019b029
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x80]
call fcn.14019af80
mov dword [rsp + 0x60], eax
mov edi, eax
test eax, eax
js 0x14019b09b
mov eax, dword [rsp + 0x64]
test eax, eax
jne 0x14019b031
lea rcx, [rsp + 0x68]
call fcn.14003bde8
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.14019a0fc
mov edi, eax
test eax, eax
jns 0x14019b0a2
mov ecx, eax
call fcn.14003e600
mov ecx, edi
call fcn.14006a86c
lea rcx, [rsp + 0x68]
call fcn.14003b9a8
mov eax, edi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14001af10
lea r11, [rsp + 0x2a0]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret