joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006adcc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x40
lea rax, [r11 - 0x18]
mov dword [rsp + 0x30], 4
mov qword [r11 - 0x20], rax
mov r14d, r9d
mov qword [r11 - 0x28], r8
lea r9, [r11 - 0x14]
mov rsi, r8
mov rdi, rdx
xor r8d, r8d
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
jne 0x14006ae5e
mov dword [rsp + 0x28], 4
lea r9d, [rax + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov dword [rsi], r14d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14006ae57
lea rcx, str.RegSetValueEx___failed__s___ec_d
jmp 0x14006ae70
mov eax, 1
jmp 0x14006ae8b
test ebx, ebx
jne 0x14006ae69
cmp dword [rsp + 0x34], 4
je 0x14006ae57
lea rcx, str.RegQueryValueEx___failed__s___ec_d
mov r8d, ebx
mov rdx, rdi
call fcn.14006d2b8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14006aeb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
and dword [rbp + 0x38], 0
lea rax, [rbp + 0x38]
mov rsi, r8
mov qword [r11 - 0x30], rax
xor ebx, ebx
mov dword [rbp - 0x10], 3
and qword [r11 - 0x38], rbx
lea r9, [rbp - 0x10]
xor r8d, r8d
mov rdi, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14006af30
cmp eax, 2
je 0x14006af3d
mov edx, eax
lea rcx, str.RegQueryValueEx___failed__ec_d
call fcn.14006d2b8
mov rcx, rbx
call fcn.140066f24
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
cmp dword [rbp - 0x10], 3
jne 0x14006af1a
mov eax, dword [rbp + 0x38]
test eax, eax
jne 0x14006af45
mov eax, 1
mov dword [rbp + 0x38], eax
lea ecx, [rax + 1]
call fcn.140066e68
mov rbx, rax
test rax, rax
je 0x14006af12
lea rax, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x38]
mov byte [rcx + rbx], 0
test eax, eax
je 0x14006afd2
cmp eax, 2
jne 0x14006af04
mov eax, dword [rbp + 0x38]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14006afd2
mov r8d, eax
lea rcx, str.RegSetValueEx___failed__s___ec_d
mov rdx, rdi
call fcn.14006d2b8
jmp 0x14006af12
test rsi, rsi
je 0x14006afdc
mov eax, dword [rbp + 0x38]
mov dword [rsi], eax
mov rax, rbx
jmp 0x14006af1c
Function at 0x14006afec
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x18], r8d
push rdi
sub rsp, 0x30
mov r9d, 4
lea rax, [r11 + 0x18]
mov dword [r11 - 0x10], r9d
xor r8d, r8d
mov qword [r11 - 0x18], rax
mov rdi, rdx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14006b04a
mov r8d, eax
lea rcx, str.RegSetValueEx___failed__s___ec_d
mov rdx, rdi
call fcn.14006d2b8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x14006b04f
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14006b064
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
push rbx
sub rsp, 0x30
test r9d, r9d
mov dword [r11 - 0x10], r9d
lea rax, [r11 + 0x20]
mov r9d, 3
cmovne rax, r8
mov rbx, rdx
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14006b0b5
mov r8d, eax
lea rcx, str.RegSetValueEx___failed__s___ec_d
mov rdx, rbx
call fcn.14006d2b8
xor eax, eax
jmp 0x14006b0ba
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x14006b0c8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, r8
test r9, r9
je 0x14006b0f4
or rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], di
jne 0x14006b0e0
lea rax, [rax*2 + 2]
jmp 0x14006b0f7
mov rax, rdi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], r9
mov r9d, edx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14006b12f
mov r8d, eax
lea rcx, str.RegSetValueEx___failed__s___ec_d
mov rdx, rbx
call fcn.14006d2b8
xor eax, eax
jmp 0x14006b134
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14006b148
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov eax, r8d
and dword [rsp + 0x60], ebx
mov r12, r9
xor ebp, ebp
mov r15d, r8d
neg eax
sbb r14d, r14d
and r14d, 6
lea r9d, [r14 + 0x20019]
call fcn.14006aa3c
mov rdi, rax
test rax, rax
je 0x14006b2e9
and qword [rsp + 0x58], rbx
lea rax, [rsp + 0x60]
and qword [rsp + 0x50], rbx
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
and qword [rsp + 0x40], rbx
lea rax, [rsp + 0xb0]
and qword [rsp + 0x38], rbx
xor edx, edx
and qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
je 0x14006b1f1
lea rcx, str.RegQueryInfoKey___failed__ec_d
jmp 0x14006b2d3
mov r9, qword [rsp + 0xc0]
xor edx, edx
mov r8d, dword [rsp + 0x64]
mov rcx, rdi
mov rax, r12
call qword [0x140087880]
test eax, eax
je 0x14006b2da
mov eax, dword [rsp + 0xb0]
add eax, 4
mov dword [rsp + 0xb0], eax
cmp eax, 0x7ffffffe
ja 0x14006b2da
lea ecx, [rax + 1]
add rcx, rcx
call fcn.140066e68
mov rbx, rax
test rax, rax
je 0x14006b2da
xor edx, edx
mov r9d, dword [rsp + 0xb0]
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x14006b2c5
lea r9d, [r14 + 0x20019]
mov r8d, r15d
mov rdx, rbx
mov rcx, rdi
call fcn.14006aa3c
mov rsi, rax
test rax, rax
je 0x14006b2b3
mov r9, qword [rsp + 0xc0]
mov rcx, rax
mov rax, r12
mov r8d, ebp
mov rdx, rbx
call qword [0x140087880]
mov rcx, rsi
test eax, eax
je 0x14006b2b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc ebp
mov edx, ebp
jmp 0x14006b249
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14006b2da
cmp eax, 0x103
je 0x14006b2da
lea rcx, str.RegEnumKey___failed__ec_d
mov edx, eax
call fcn.14006d2b8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rbx
call fcn.140066f24
lea r11, [rsp + 0x70]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14006b314
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14009b940]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x48], 0
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [0x14009b028]
lea r12, [0x14009b028]
cmp rcx, r12
je 0x14006b382
test byte [rcx + 0x1c], 2
je 0x14006b382
cmp byte [rcx + 0x19], 5
jb 0x14006b382
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b378]
mov edx, 0xa
call fcn.140001024
lea rax, [rsp + 0x48]
mov r9d, 0x3001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14006b405
mov rcx, qword [0x14009b028]
cmp rcx, r12
je 0x14006b4e2
test byte [rcx + 0x1c], 2
je 0x14006b4e2
cmp byte [rcx + 0x19], 2
jb 0x14006b4e2
mov edx, VariantTimeToDosDateTime
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b378]
mov r9d, ebx
call fcn.140001050
jmp 0x14006b4e2
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call fcn.14006b314
test eax, eax
je 0x14006b4f0
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rsp + 0x48]
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14006b3ee
cmp eax, 0x103
jne 0x14006b4a1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14006b49a
mov rcx, qword [0x14009b028]
cmp rcx, r12
je 0x14006b4e2
test byte [rcx + 0x1c], 2
je 0x14006b4e2
cmp byte [rcx + 0x19], 2
jb 0x14006b4e2
mov edx, 0xd
jmp 0x14006b3d6
mov eax, 1
jmp 0x14006b4f2
mov rcx, qword [0x14009b028]
cmp rcx, r12
je 0x14006b4d1
test byte [rcx + 0x1c], 2
je 0x14006b4d1
cmp byte [rcx + 0x19], 2
jb 0x14006b4d1
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b378]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov r9d, ebx
call fcn.140001050
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14007e3c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x14006b520
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r15
sub rsp, 0x40
and dword [rax - 0x28], 0
mov rbp, r8
mov rdi, rdx
mov dword [rax + 0x20], 4
mov rsi, rcx
mov rcx, qword [0x14009b028]
lea r15, [0x14009b028]
cmp rcx, r15
je 0x14006b57b
test byte [rcx + 0x1c], 2
je 0x14006b57b
cmp byte [rcx + 0x19], 5
jb 0x14006b57b
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b378]
mov edx, 0xe
call fcn.140001024
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
and qword [rsp + 0x20], 0
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14006b5d9
mov rcx, qword [0x14009b028]
cmp rcx, r15
je 0x14006b673
test byte [rcx + 0x1c], 2
je 0x14006b673
cmp byte [rcx + 0x19], 2
jb 0x14006b673
mov edx, 0xf
jmp 0x14006b660
cmp dword [rsp + 0x78], 4
je 0x14006b614
mov rcx, qword [0x14009b028]
cmp rcx, r15
je 0x14006b60d
test byte [rcx + 0x1c], 2
je 0x14006b60d
cmp byte [rcx + 0x19], 2
jb 0x14006b60d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b378]
mov edx, 0x10
call fcn.140001024
mov ebx, 0x3f1
jmp 0x14006b673
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
mov rdx, rdi
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14006b673
mov rcx, qword [0x14009b028]
cmp rcx, r15
je 0x14006b673
test byte [rcx + 0x1c], 2
je 0x14006b673
cmp byte [rcx + 0x19], 2
jb 0x14006b673
mov edx, 0x11
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b378]
mov r9d, eax
call fcn.140001050
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x14006bd84
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x150
mov rax, qword [0x14009b940]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.msvcrt.dll_memset
mov rcx, qword [0x14009b028]
lea rdi, [0x14009b028]
cmp rcx, rdi
je 0x14006bde5
test byte [rcx + 0x1c], 2
je 0x14006bde5
cmp byte [rcx + 0x19], 5
jb 0x14006bde5
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b4b8]
mov edx, 0xa
call fcn.140001024
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
xor edx, edx
test eax, eax
jne 0x14006be55
mov rax, qword [0x14009b028]
cmp rax, rdi
je 0x14006beaf
test byte [rax + 0x1c], 2
je 0x14006beaf
cmp byte [rax + 0x19], 2
jb 0x14006beaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b028]
lea r8, [0x14008b4b8]
mov r9d, eax
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rcx, qword [rcx + 0x10]
call fcn.140001050
jmp 0x14006beaf
cmp dword [rsp + 0x30], 2
je 0x14006be7b
mov rcx, qword [0x14009b028]
cmp rcx, rdi
je 0x14006beaf
test byte [rcx + 0x1c], 2
je 0x14006beaf
cmp byte [rcx + 0x19], 3
jb 0x14006beaf
mov edx, 0xd
jmp 0x14006be9f
cmp dword [rsp + 0x24], 5
jae 0x14006beb6
mov rcx, qword [0x14009b028]
cmp rcx, rdi
je 0x14006beaf
test byte [rcx + 0x1c], 2
je 0x14006beaf
cmp byte [rcx + 0x19], 3
jb 0x14006beaf
mov edx, 0xe
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b4b8]
call fcn.140001024
xor eax, eax
jmp 0x14006bf38
mov cl, byte [rsp + 0x138]
mov eax, 0x40
test al, cl
je 0x14006bed6
cmp byte [rsp + 0x13a], 1
lea ecx, [rax - 0x20]
cmove eax, ecx
jmp 0x14006bf38
mov eax, 0x200
test word [rsp + 0x138], ax
je 0x14006beec
mov eax, 1
jmp 0x14006bf38
test cl, 2
je 0x14006bef8
mov eax, 8
jmp 0x14006bf38
mov eax, 0x80
test al, cl
je 0x14006bf08
mov eax, 0x10
jmp 0x14006bf38
mov ecx, 0x400
test word [rsp + 0x138], cx
jne 0x14006bf38
mov cl, byte [rsp + 0x13a]
cmp cl, 1
jne 0x14006bf2a
mov eax, 2
jmp 0x14006bf38
sub cl, 2
mov eax, 4
cmp cl, 1
cmova eax, edx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14007e3c0
add rsp, 0x150
pop rdi
ret
Function at 0x14006d118
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x14009b940]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, 0x208
lea rcx, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, ebx
lea rcx, [rsp + 0x250]
xor edx, edx
call sub.msvcrt.dll_memset
cmp qword [0x14009bd40], 0xffffffffffffffff
je 0x14006d174
lock inc dword [0x14009f524]
mov eax, 1
jmp 0x14006d1ff
mov ebx, 0x104
lea rdx, [rsp + 0x40]
mov r8d, ebx
lea rcx, [0x140088660]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
ja 0x14006d1fd
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14006d219
lea rdx, [rsp + 0x250]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
test eax, eax
je 0x14006d1fd
lea rax, [rsp + 0x40]
mov edx, ebx
lea r9, [rsp + 0x250]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [0x14009f530]
call fcn.140002ac0
test eax, eax
jns 0x14006d22f
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14007e3c0
add rsp, 0x470
pop rbx
ret
lea r8, [rsp + 0x40]
mov rdx, rbx
lea rcx, [0x14009f530]
call fcn.140002b44
jmp 0x14006d1f9
mov dword [rsp + 0x28], 0x80
lea rcx, [0x14009f530]
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
mov r8d, 3
call fcn.140069a1c
mov qword [0x14009bd40], rax
cmp rax, 0xffffffffffffffff
je 0x14006d1fd
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14006d2a2
mov rcx, qword [0x14009bd40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or qword [0x14009bd40], 0xffffffffffffffff
jmp 0x14006d1fd
mov eax, 1
xchg dword [0x14009f524], eax
jmp 0x14006d16a
Function at 0x14006d2b8
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
push rdi
lea rbp, [rax - 0x778]
sub rsp, 0x860
mov rax, qword [0x14009b940]
xor rax, rsp
mov qword [rbp + 0x750], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x800
call sub.msvcrt.dll_memset
xor edi, edi
cmp dword [0x14009f528], edi
jne 0x14006d3be
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftFaxClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14006d345
mov eax, edi
jmp 0x14006d3a5
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DebugLevel
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14006d38c
cmp dword [rsp + 0x38], 4
je 0x14006d390
mov dword [rsp + 0x30], edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
mov rbx, qword [rbp + 0x780]
mov dword [0x14009bd48], eax
mov dword [0x14009f528], 1
jmp 0x14006d3c4
mov eax, dword [0x14009bd48]
test eax, eax
jle 0x14006d467
mov r8, rbx
lea r9, [rbp + 0x788]
mov ebx, 0x3ff
lea rcx, [rsp + 0x50]
mov edx, ebx
call qword [sym.imp.msvcrt.dll__vsnwprintf]
nop dword [rax + rax]
test eax, eax
js 0x14006d467
cdqe
cmp rax, rbx
ja 0x14006d467
jne 0x14006d402
mov word [rbp + 0x74e], di
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x14006d40b
mov edx, 0x3fd
mov r8d, 0xa
cmp rax, rdx
cmovb edx, eax
lea eax, [rdx - 1]
cmp word [rsp + rax*2 + 0x50], r8w
je 0x14006d456
lea ecx, [r8 + 3]
mov word [rsp + rdx*2 + 0x50], cx
lea eax, [rdx + 1]
lea ecx, [rdx + 2]
mov word [rsp + rax*2 + 0x50], r8w
add rcx, rcx
cmp rcx, 0x800
jae 0x14006d482
mov word [rsp + rcx + 0x50], di
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x750]
xor rcx, rsp
call fcn.14007e3c0
add rsp, 0x860
pop rdi
pop rbx
pop rbp
ret
call fcn.14007e658
int3
Function at 0x14006d87c
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14009b940]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r13d, dword [rsp + 0xb8]
xor edi, edi
mov r14, qword [rsp + 0xc0]
xor ebx, ebx
mov rbp, r9
mov r15, r8
mov r12, rdx
mov rcx, qword [0x14009b028]
lea rax, [0x14009b028]
cmp rcx, rax
je 0x14006d8ee
test byte [rcx + 0x1c], 2
je 0x14006d8ee
cmp byte [rcx + 0x19], 5
jb 0x14006d8ee
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xa]
lea r8, [0x14008b5b0]
call fcn.140001024
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14006d95e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
lea rax, [0x14009b028]
cmp rcx, rax
je 0x14006da0f
test byte [rcx + 0x1c], 2
je 0x14006da0f
cmp byte [rcx + 0x19], 2
jb 0x14006da0f
lea edx, [rsi + 0xb]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b5b0]
mov r9d, ebx
call fcn.140001050
jmp 0x14006da0f
mov r8d, r13d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14006d9ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
lea rax, [0x14009b028]
cmp rcx, rax
je 0x14006da0f
test byte [rcx + 0x1c], 2
je 0x14006da0f
cmp byte [rcx + 0x19], 2
jb 0x14006da0f
lea edx, [rdi + 0xc]
jmp 0x14006d946
test r14, r14
je 0x14006da08
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
jne 0x14006da01
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
lea rax, [0x14009b028]
cmp rcx, rax
je 0x14006da0f
test byte [rcx + 0x1c], 2
je 0x14006da0f
cmp byte [rcx + 0x19], 2
jb 0x14006da0f
mov edx, 0xd
jmp 0x14006d946
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
mov qword [r15], rsi
mov qword [rbp], rdi
test ebx, ebx
je 0x14006da1e
mov rdx, rdi
mov rcx, rsi
call fcn.14006da4c
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14007e3c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006db68
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rcx, qword [0x14009b028]
lea r14, [0x14009b028]
cmp rcx, r14
je 0x14006dbb1
test byte [rcx + 0x1c], 2
je 0x14006dbb1
cmp byte [rcx + 0x19], 5
jb 0x14006dbb1
mov rcx, qword [rcx + 0x10]
lea r8, [0x14008b5b0]
mov edx, 0x11
call fcn.140001024
mov ebx, 0x100000
lea r8, str.GlobalFaxSvcRPCStarted_1ed23866_f90b_4ec5_b77e_36e8709422b6
mov ecx, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
nop dword [rax + rax]
test rax, rax
jne 0x14006dcf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14006dc12
mov rax, qword [0x14009b028]
cmp rax, r14
je 0x14006dc6a
test byte [rax + 0x1c], 2
je 0x14006dc6a
cmp byte [rax + 0x19], 2
jb 0x14006dc6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x12
jmp 0x14006dc50
mov r8d, 0x1f0003
mov edx, ebx
mov ecx, ebx
call fcn.14006eaa4
mov rsi, rax
test rax, rax
jne 0x14006dc71
mov rax, qword [0x14009b028]
cmp rax, r14
je 0x14006dc6a
test byte [rax + 0x1c], 2
je 0x14006dc6a
cmp byte [rax + 0x19], 2
jb 0x14006dc6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea edx, [rsi + 0x13]
mov rcx, qword [0x14009b028]
lea r8, [0x14008b5b0]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.140001050
xor eax, eax
jmp 0x14006dcf2
xor r8d, r8d
lea r9, str.GlobalFaxSvcRPCStarted_1ed23866_f90b_4ec5_b77e_36e8709422b6
mov rcx, rsi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14006dcd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [0x14009b028]
cmp rcx, r14
je 0x14006dcd4
test byte [rcx + 0x1c], 2
je 0x14006dcd4
cmp byte [rcx + 0x19], 2
jb 0x14006dcd4
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x14]
mov r9d, eax
lea r8, [0x14008b5b0]
call fcn.140001050
mov rcx, rsi
call fcn.14006f004
test rbx, rbx
jne 0x14006dcef
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret