joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a8f7c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rbx, rdx
mov dword [rsp + 0x30], 0x104
mov rdi, rcx
mov dword [rsp + 0x34], 0x10
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x208
call sub.msvcrt.dll_memset
xor eax, eax
lea r8, [rsp + 0x30]
xor esi, esi
mov qword [rbp - 0x1e], rax
xor r9d, r9d
mov qword [rbp - 0x16], rax
lea rdx, [rbp]
mov qword [rbp - 0xe], rax
mov rcx, rbx
mov dword [rbp - 6], eax
mov word [rbp - 2], ax
mov word [rbp - 0x20], si
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_2.dll_GetClusterResourceState]
lea rdx, [rsp + 0x34]
mov ebx, eax
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_1.dll_GetComputerNameW]
cmp ebx, 2
je 0x1400a9075
lea rax, str.base_stor_vssmodulescoord_srchwresync.cxx
mov dword [rsp + 0x50], 0xc89
mov qword [rsp + 0x38], rax
lea r8d, [rsi + 0x78]
lea rax, str.CVssHardwareProviderWrapper::CheckIsOnlineOnMachine
mov dword [rsp + 0x54], 1
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
lea rax, str.CORHRSNC
mov dword [rsp + 0x58], 0xff
xor edx, edx
mov qword [rsp + 0x48], rax
mov dword [rbp - 0x28], 0x1000000
call sub.msvcrt.dll_memset
lea r8, str.This_cluster_resource_is_not_online_on_any_machine
jmp 0x1400a915a
test eax, eax
je 0x1400a9100
mov r8d, 0xf
lea rdx, [rbp - 0x20]
lea rcx, [rbp]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1400a9100
lea rax, str.base_stor_vssmodulescoord_srchwresync.cxx
mov dword [rsp + 0x50], 0xc92
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x54], 1
lea rax, str.CVssHardwareProviderWrapper::CheckIsOnlineOnMachine
mov dword [rsp + 0x58], 0xff
mov qword [rsp + 0x40], rax
lea rax, str.CORHRSNC
mov qword [rsp + 0x48], rax
lea r8d, [rdx + 0x78]
mov dword [rbp - 0x28], 0x1000000
call sub.msvcrt.dll_memset
lea r8, str.Cluster_resource_is_online_on_this_machine
mov rcx, rdi
lea rdx, [rsp + 0x38]
call fcn.1400037d0
mov al, 1
jmp 0x1400a9169
lea rax, str.base_stor_vssmodulescoord_srchwresync.cxx
mov dword [rsp + 0x50], 0xc8e
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x54], 1
lea rax, str.CVssHardwareProviderWrapper::CheckIsOnlineOnMachine
mov dword [rsp + 0x58], 0xff
mov qword [rsp + 0x40], rax
lea rax, str.CORHRSNC
mov qword [rsp + 0x48], rax
lea r8d, [rdx + 0x78]
mov dword [rbp - 0x28], 0x1000000
call sub.msvcrt.dll_memset
lea r8, str.This_cluster_resource_is_not_online_on_this_machine
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.1400037d0
xor al, al
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14001ff30
mov rbx, qword [rsp + 0x350]
add rsp, 0x320
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ba0d8
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov rdi, rcx
call qword [sym.imp.VssTrace.DLL_Ordinal_11]
cmp eax, dword [rdi + 4]
je 0x1400ba22e
mov rdx, qword [rdi + 0x28]
lea r8, [rsp + 0x50]
mov ecx, dword [rdi + 0x24]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov dword [rdi + 4], eax
call qword [sym.imp.VssTrace.DLL_Ordinal_8]
test eax, eax
je 0x1400ba13a
mov eax, dword [rsp + 0x50]
jmp 0x1400ba150
mov rcx, qword [rdi + 0x60]
test rcx, rcx
je 0x1400ba14a
call fcn.14003e904
jmp 0x1400ba150
call qword [sym.imp.VssTrace.DLL_Ordinal_6]
mov dword [rdi], eax
mov eax, dword [rdi + 4]
cmp dword [0x1401543d0], eax
je 0x1400ba22e
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x800
call sub.msvcrt.dll_memset
lea rdx, [rbp]
call fcn.14003e6d0
lea rax, str.base_stor_vssmodules_trace_fntracer.cpp
mov dword [rsp + 0x70], 0x252
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x80]
xor edx, edx
mov dword [rsp + 0x74], reloc.VssTrace.DLL_Ordinal_11
lea rax, str.CVssFunctionTracer::UpdateLocalIsTracingEnabledFlag
mov dword [rsp + 0x78], 0xff
mov qword [rsp + 0x60], rax
lea rax, str.TRCTRCC
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 0x78]
mov dword [rbp - 8], 0x1000000
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetCommandLineW]
mov rbx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcessId]
mov ecx, dword [rdi + 4]
lea r8, str.TRACING_STARTED
mov dword [rsp + 0x48], ecx
lea rdx, [rsp + 0x58]
mov ecx, dword [0x1401543d0]
mov r9d, 0x78
mov dword [rsp + 0x40], ecx
lea rcx, [rbp]
mov qword [rsp + 0x38], rcx
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
lea rax, str.Tracing_started_or_updated._PID_d__CommandLine__s___UserName__s_._SQN__d_____d_
mov qword [rsp + 0x20], rax
call fcn.140003760
mov eax, dword [rdi + 4]
mov dword [0x1401543d0], eax
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.14001ff30
lea r11, [rsp + 0x910]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400bc5a0
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x48]
sub rsp, 0x140
lea rax, str.base_stor_vssmodules_sec_security.cxx
mov dword [rsp + 0x38], 0x3a2
mov qword [rsp + 0x20], rax
mov rdi, rdx
lea rax, str.CAutoSid::operator_
mov dword [rsp + 0x3c], reloc.VssTrace.DLL_Ordinal_11
mov qword [rsp + 0x28], rax
mov rbx, rcx
lea rax, str.SECSECRC
mov dword [rsp + 0x40], 0xff
xor esi, esi
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rbp - 0x40], 0x1000000
lea rcx, [rsp + 0x48]
lea r8d, [rsi + 0x78]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.140003840
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x1400bc639
cmp qword [rdi + 8], rsi
sete dl
jmp 0x1400bc64d
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1400bc64d
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_EqualSid]
test eax, eax
setne dl
lea rcx, [rbp - 0x30]
call fcn.140013f94
lea rcx, [rbp - 0x30]
mov bl, al
call fcn.140003960
lea r11, [rsp + 0x140]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400c8e1c
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rbx, rcx
lea r14, str.base_stor_vssmodules_registry_registry.cxx
mov qword [rsp + 0x40], r14
lea r15, str.CVssRegistryKeyIterator::GetCurrentKeyName
mov qword [rsp + 0x48], r15
lea r12, str.REGREGSC
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], 0x2cf
mov dword [rsp + 0x5c], reloc.VssTrace.DLL_Ordinal_11
mov edi, 0xff
mov dword [rsp + 0x60], edi
xor esi, esi
mov dword [rbp - 0x20], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.140003840
nop
cmp byte [rbx + 0x28], sil
je 0x1400c8fd4
mov r8, qword [rbx + 0x20]
test r8, r8
je 0x1400c8fd4
mov eax, dword [rbx + 0x10]
mov dword [rbp + 0xa0], eax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xa0]
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov edi, eax
test eax, eax
je 0x1400c8fc2
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x5c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x60], 0xff
mov dword [rbp - 0x20], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x68]
cmp eax, 0x103
je 0x1400c8f8b
mov dword [rsp + 0x58], 0x2e8
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x20]
test edi, edi
jle 0x1400c8f54
movzx edi, di
or edi, 0x80070000
mov eax, dword [rbp + 0xa0]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rcx
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
lea r9, str.RegEnumKeyExW__p__lu__p__lu_..._
mov r8d, edi
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.1400b8b90
int3
mov dword [rsp + 0x58], 0x2ec
call sub.msvcrt.dll_memset
mov eax, dword [rbx + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x20], eax
lea r9, str.Unexpected_error:_dwIndex_out_of_scope__lu__lu
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.1400b8b90
int3
mov rbx, qword [rbx + 0x20]
lea rcx, [rbp - 0x10]
call fcn.140003960
mov rax, rbx
jmp 0x1400c902a
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], 0x2d3
mov dword [rsp + 0x5c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x60], edi
mov dword [rbp - 0x20], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
lea r9, str.Unexpected_error:_noninitialized_iterator
mov r8d, 0x8000ffff
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.1400b8238
nop
add rsp, 0x160
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400cd82c
Capabilities:
Get disk information
Get disk size

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, qword [rbp + 0x68]
xor r12d, r12d
mov r14, rcx
mov word [rdx], r12w
mov rsi, r9
mov dword [rbp + 0x48], r12d
mov rbx, rdx
mov dword [rbp + 0x60], r12d
lea r15d, [r12 + 1]
mov dword [rbp + 0x50], r12d
mov ecx, r15d
mov dword [rbp - 0x10], r12d
mov dword [rbp + 0x58], r12d
mov word [r9], r12w
mov dword [rdi], r12d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetErrorMode]
mov dword [rsp + 0x38], 0x10
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, 0x100
mov rdx, rsi
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeInformationW]
lea r9, [rbp - 0x10]
mov rcx, r14
mov ebx, eax
lea r8, [rbp + 0x50]
lea rax, [rbp + 0x58]
lea rdx, [rbp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDiskFreeSpaceW]
mov ecx, dword [rbp + 0x50]
imul ecx, dword [rbp + 0x60]
mov dword [rdi], ecx
test ebx, ebx
je 0x1400cd8e0
test eax, eax
jne 0x1400cd8e3
mov r15d, r12d
mov eax, r15d
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400d4688
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [rbx + 0x20]
lea ecx, [rbx + 0x5a]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400d46c2
cmp dword [rsp + 0x30], 3
cmovl ebx, dword [rsp + 0x30]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001ff30
add rsp, 0x50
pop rbx
ret
Function at 0x1400dc720
Capabilities:
Check if file exists
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rcx, str.AsrRegClearExitCode
call fcn.140008368
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
xor edx, edx
lea rcx, str.SOFTWAREMICROSOFTWINDOWS_NTCurrentVersionASRBackupSession
call fcn.1400e115c
test eax, eax
jne 0x1400dc7ba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 2
je 0x1400dc7ff
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dc804
test byte [rcx + 0x1c], 8
je 0x1400dc804
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x140154180]
lea edx, [rbx + 0x20]
mov r9d, eax
lea rax, str.GetLastError___
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cae0]
mov qword [rsp + 0x20], rax
call fcn.1400cc0d8
jmp 0x1400dc804
mov rcx, qword [rsp + 0x48]
lea rdx, str.BackupExitCode
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov edi, eax
test eax, 0xfffffffd
je 0x1400dc7ff
xor ebx, ebx
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dc804
test byte [rcx + 0x1c], 8
je 0x1400dc804
lea edx, [rbx + 0x21]
mov r9d, edi
lea rax, str.lDeleteValueResult
jmp 0x1400dc7a3
xor edi, edi
lea ebx, [rdi + 1]
cmp qword [rsp + 0x48], 0
je 0x1400dc817
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, str.AsrRegClearExitCode
call fcn.1400084a8
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400dcc00
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rsi, rcx
xor ebx, ebx
lea edi, [rbx + 1]
test rcx, rcx
jne 0x1400dcc7f
lea r9d, [rcx + 0x57]
mov edi, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dcd7f
test byte [rcx + 0x1c], 8
je 0x1400dcd7f
lea edx, [rsi + 0xe]
lea rax, [0x14012cb00]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012caf0]
mov qword [rsp + 0x20], rax
call fcn.1400cc0d8
jmp 0x1400dcd7f
mov edx, 0x105
lea rcx, [rsp + 0xa0]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemWindowsDirectoryW]
test eax, eax
jne 0x1400dccdf
mov edi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dcd7f
test byte [rcx + 0x1c], 8
je 0x1400dcd7f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0xf
mov rcx, qword [0x140154180]
mov r9d, eax
lea rax, str.GetLastError___
jmp 0x1400dcc65
cmp eax, 0x104
jbe 0x1400dcd1a
mov r9d, 0x7a
mov edi, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dcd7f
test byte [rcx + 0x1c], 8
je 0x1400dcd7f
lea edx, [r9 - 0x6a]
lea rax, str.ERROR_INSUFFICIENT_BUFFER
jmp 0x1400dcc65
mov r8d, 0x32
mov word [rsp + 0xa6], bx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x1400dcd72
mov edi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400dcd7f
test byte [rcx + 0x1c], 8
je 0x1400dcd7f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x11
jmp 0x1400dcccc
lea rcx, [rsp + 0x30]
call fcn.1400dd9fc
mov qword [rsi], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14001ff30
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400ddfbc
Capabilities:
Access the windows event log

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movzx r14d, dx
mov ebp, ecx
xor ebx, ebx
lea rcx, str.LogEvent
lea edi, [rbx + 1]
call fcn.140008368
xor edx, edx
lea r8d, [rbx + 0x50]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
lea rdx, [0x1401220f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
jne 0x1400de082
mov edi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov rdx, qword [0x140154180]
lea rcx, [0x140154180]
cmp rdx, rcx
je 0x1400de1a7
test byte [rdx + 0x1c], 8
je 0x1400de1a7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x140154180]
lea edx, [rsi + 0xd]
mov r9d, eax
lea r8, [0x14012cfc8]
lea rax, str.GetLastError__
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400cc0d8
jmp 0x1400de1a7
mov r9d, dword [rsp + 0xf0]
cmp r9d, 0xa
jle 0x1400de0e9
mov r8d, 0x7a
mov edi, ebx
mov ebx, r8d
mov rax, qword [0x140154180]
lea rcx, [0x140154180]
cmp rax, rcx
je 0x1400de19e
test byte [rax + 0x1c], 8
je 0x1400de19e
mov dword [rsp + 0x28], r9d
lea rcx, str.ERROR_INSUFFICIENT_BUFFER
mov qword [rsp + 0x20], rcx
lea edx, [r8 - 0x6c]
mov rcx, qword [rax + 0x10]
mov r9d, r8d
lea r8, [0x14012cfc8]
call fcn.1400ceaf0
jmp 0x1400de19e
lea rcx, [rsp + 0xf8]
test r9d, r9d
jle 0x1400de115
add rcx, 0xfffffffffffffff8
lea r8, [rsp + 0x50]
mov r10, r9
lea rcx, [rcx + 8]
mov rax, qword [rcx]
mov qword [r8], rax
lea r8, [r8 + 8]
sub r10, rdi
jne 0x1400de102
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ebx
movzx edx, r14w
mov word [rsp + 0x28], r9w
mov rcx, rsi
mov r9d, ebp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_ReportEventW]
test eax, eax
jne 0x1400de19e
mov edi, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov rax, qword [0x140154180]
lea rcx, [0x140154180]
cmp rax, rcx
je 0x1400de19e
test byte [rax + 0x1c], 8
je 0x1400de19e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x140154180]
lea r8, [0x14012cfc8]
mov r9d, eax
mov edx, 0xf
lea rax, str.GetLastError__
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400cc0d8
mov rcx, rsi
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_DeregisterEventSource]
lea rcx, str.LogEvent
call fcn.1400084a8
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14001ff30
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400e129c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov rbp, rdx
mov r12, rcx
xor ebx, ebx
mov dword [rax + 0x10], 0x100
mov dword [rax - 0x38], ebx
mov edi, ebx
lea esi, [rbx + 1]
test rdx, rdx
je 0x1400e13c4
cmp word [rdx], bx
je 0x1400e13c4
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov ecx, dword [rsp + 0x78]
call fcn.1400ddeec
mov rdi, rax
test rax, rax
je 0x1400e1393
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov r9d, eax
test eax, eax
je 0x1400e1367
cmp eax, 0xea
je 0x1400e12e2
mov esi, ebx
mov ebx, eax
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400e1408
test byte [rcx + 0x1c], 8
je 0x1400e1408
mov edx, 0x16
lea rax, str.lResult
jmp 0x1400e13f3
test r15, r15
je 0x1400e1372
mov qword [r15], rdi
mov rdi, rbx
test r14, r14
je 0x1400e137e
mov eax, dword [rsp + 0x78]
mov dword [r14], eax
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400e1408
mov eax, dword [rsp + 0x30]
mov dword [rcx], eax
jmp 0x1400e1408
mov r9d, 0xe
mov esi, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400e1408
test byte [rcx + 0x1c], 8
je 0x1400e1408
lea edx, [r9 + 7]
lea rax, str.pValue
jmp 0x1400e13f3
mov r9d, 0x57
mov esi, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400e1408
test byte [rcx + 0x1c], 8
je 0x1400e1408
lea edx, [r9 - 0x43]
lea rax, str.pwszValueName
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012dba0]
mov qword [rsp + 0x20], rax
call fcn.1400cc0d8
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400e16dc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
lea edi, [rbx + 1]
test rdx, rdx
je 0x1400e173e
test r8, r8
je 0x1400e173e
lea r9d, [rbx + 4]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov r9d, eax
test eax, eax
je 0x1400e1782
mov edi, ebx
mov ebx, eax
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400e1782
test byte [rcx + 0x1c], 8
je 0x1400e1782
mov edx, 0x24
lea rax, str.lResult
jmp 0x1400e176d
mov r9d, 0x57
mov edi, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rax, [0x140154180]
cmp rcx, rax
je 0x1400e1782
test byte [rcx + 0x1c], 8
je 0x1400e1782
lea edx, [r9 - 0x34]
lea rax, str.ERROR_INVALID_PARAMETER
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012dba0]
mov qword [rsp + 0x20], rax
call fcn.1400cc0d8
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140017f80]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x140017f90]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.14000ff70
jmp 0x14000123c
mov rax, qword [0x140017f90]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x140017f90]
mov dword [rax], 1
mov rax, qword [0x140017fd0]
mov rdx, rax
mov rax, qword [0x140017fc0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000123c
mov dword [0x14001d024], 1
mov rax, qword [0x140017f90]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x140017fb0]
mov rdx, rax
mov rax, qword [0x140017fa0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov rax, qword [0x140017f90]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140017f80]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x140017ed0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x140017ed0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.14000e5b8
mov rax, qword [0x140018010]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140017f70]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.14000ddb0
mov eax, dword [0x14001d004]
lea rdx, [0x14001d008]
mov ecx, eax
call fcn.14000147c
call fcn.14000da27
mov rax, qword [0x140017f00]
mov rax, qword [rax]
mov rdx, qword [0x14001d010]
mov qword [rax], rdx
mov rcx, qword [0x14001d010]
mov rdx, qword [0x14001d008]
mov eax, dword [0x14001d004]
mov r8, rcx
mov ecx, eax
call fcn.14000da50
mov dword [0x14001d01c], eax
mov eax, dword [0x14001d020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14001d01c]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x14001d024]
test eax, eax
jne 0x14000136c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14001d01c]
add rsp, 0x70
pop rbp
ret