joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140253e70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call fcn.140057e30
test rax, rax
jne 0x140253eae
mov rcx, rdi
call fcn.14004fe90
test al, al
je 0x140253eae
mov r8d, Ordinal_41
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14004ebf0
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140256480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1402564aa
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402564f2
test bl, bl
jne 0x1402564ea
mov ecx, eax
and ecx, 0x400
je 0x1402564ea
xor eax, eax
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1402564df
call fcn.1401ac870
int3
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
and eax, 0x10
shr eax, 4
jmp 0x1402564c5
mov ecx, 2
call fcn.1401a8160
test al, al
je 0x1402564c3
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, Ordinal_133
mov r9d, 2
call fcn.14022a1d0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14018fa80
mov rcx, rax
mov rdx, rsi
call fcn.14022b160
mov rcx, rdi
call fcn.14022a240
jmp 0x1402564c3

Function at 0x140256560
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14025658b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x140256612
test bl, bl
je 0x1402565af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140256639
mov ecx, 2
call fcn.1401a8160
test al, al
je 0x140256610
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.14022a1d0
lea rcx, [rsp + 0x40]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14018fa80
mov rcx, rax
mov rdx, rsi
call fcn.14022b160
mov rcx, rdi
call fcn.14022a240
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14025662c
call fcn.1401ac870
int3
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140256480
test al, al
jne 0x140256612
mov ecx, 2
call fcn.1401a8160
test al, al
je 0x140256610
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.14002e970
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.14022b160
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.14018fa80
mov rcx, rdi
call fcn.140001aa0
jmp 0x140256610
Function at 0x1402566b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x1402566d7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14025670e
test eax, 0x410
sete al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x140256704
call fcn.1401ac870
int3
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1401a8160
test al, al
je 0x14025676f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, Ordinal_117
mov r9d, 2
call fcn.14022a1d0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14018fa80
mov rcx, rax
mov rdx, rsi
call fcn.14022b160
mov rcx, rdi
call fcn.14022a240
xor eax, eax
jmp 0x1402566ea

Function at 0x140256780
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x1402567a7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x140256866
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1402567d1
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x140256842
mov ecx, 2
call fcn.1401a8160
test al, al
je 0x140256840
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, reloc.WLDAP32.dll_Ordinal_147
mov r9d, 2
call fcn.14022a1d0
lea rcx, [rsp + 0x38]
lea rdx, str.DeleteFile
mov r8d, Ordinal_14
call fcn.14018fa80
mov rcx, rax
mov rdx, rsi
call fcn.14022b160
mov rcx, rdi
call fcn.14022a240
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14025685c
call fcn.1401ac870
int3
add rsp, 0x168
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401ac870
mov rcx, rsi
add rsp, 0x168
pop rdi
pop rsi
jmp fcn.140256890
Function at 0x140256890
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1402568b8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x1402568ee
test edi, edi
setne al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1402568e3
call fcn.1401ac870
int3
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1401a8160
test al, al
je 0x1402568c4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.14022a1d0
lea rcx, [rsp + 0x40]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.14018fa80
mov rcx, rax
mov rdx, rsi
call fcn.14022b160
mov rcx, rbx
call fcn.14022a240
jmp 0x1402568c4
Function at 0x14026b380
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x3c]
mov dword [rdi], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete al
jne 0x14026b3df
mov ecx, dword [rsp + 0x38]
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14026b3f6
call fcn.1401ac870
int3
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14026b4a0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x190
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x188], rax
movaps xmm0, xmmword [0x140299a90]
lea rsi, [rsp + 0x150]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x14026b533
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14026b533
lea rdx, str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x10a
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, Ordinal_46
call fcn.14018fa80
mov rcx, rsi
call fcn.140001aa0
mov ecx, dword [rsp + 0x170]
cmp ecx, 0x100
mov eax, 0xff
cmovb eax, ecx
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14026b562
call fcn.1401ac870
int3
add rsp, 0x190
pop rsi
ret
Function at 0x14027f0f0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x140299a90]
lea r15, [rsp + 0x150]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401e9700
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140288330
test al, al
je 0x14027f203
cmp word [rsp + 0x150], 0x5a4d
jne 0x14027f1bd
mov rcx, r14
call fcn.1401e9700
movsxd r14, dword [rsp + 0x18c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140288330
test al, al
je 0x14027f297
cmp dword [rbx], 0x4550
jne 0x14027f2d6
mov al, 1
test rdi, rdi
je 0x14027f26e
mov qword [rdi], r14
jmp 0x14027f26e
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14027f26c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14027f243
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14027f26c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14018fa80
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x14027f259
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.14018fa80
mov rcx, rdi
call fcn.140001aa0
xor eax, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14027f288
call fcn.1401ac870
int3
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14027f26c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14027f23d
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14027f26c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14027f243
Function at 0x14027f320
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x140299a90]
lea r15, [rsp + 0x150]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401e9700
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140288330
test al, al
je 0x14027f433
cmp word [rsp + 0x150], 0x5a4d
jne 0x14027f3ed
mov rcx, r14
call fcn.1401e9700
movsxd r14, dword [rsp + 0x18c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140288330
test al, al
je 0x14027f4c7
cmp dword [rbx], 0x4550
jne 0x14027f506
mov al, 1
test rdi, rdi
je 0x14027f49e
mov qword [rdi], r14
jmp 0x14027f49e
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14027f49c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14027f473
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14027f49c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14018fa80
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x14027f489
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.14018fa80
mov rcx, rdi
call fcn.140001aa0
xor eax, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x14027f4b8
call fcn.1401ac870
int3
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14027f49c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14027f46d
mov ecx, 1
call fcn.1401a8160
test al, al
je 0x14027f49c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14002e970
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14027f473
Function at 0x140001120
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax]
mov r9, qword [rdx + 0x20]
test r9, r9
je 0x140001157
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140001259
movsxd rcx, dword [r9 + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
jne 0x140001259
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov edi, ebx
mov qword [rsp + 0x60], rbx
mov r8d, ebx
movzx r11d, word [rcx + 0x14]
movzx r10d, word [rcx + 6]
add r11, rcx
test r10, r10
je 0x1400011e5
mov edx, ebx
lea rcx, [r11 + 0x18]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx]
or eax, 0x20202020
cmp eax, 0x7865742e
je 0x1400011bf
inc r8d
inc rdx
add rcx, 0x28
cmp rdx, r10
jl 0x1400011a0
jmp 0x1400011e5
movsxd rax, r8d
lea rcx, [rax + rax*4]
mov eax, dword [r11 + rcx*8 + 0x24]
add rax, r9
mov qword [rsp + 0x68], rax
mov edi, dword [r11 + rcx*8 + 0x24]
mov eax, dword [r11 + rcx*8 + 0x20]
add rdi, rsi
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], ebx
mov r9d, 0x80
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x68]
call fcn.14000166d
test eax, eax
jne 0x140001259
mov r8, qword [rsp + 0x60]
mov rdx, rdi
mov rcx, qword [rsp + 0x68]
call section..text
mov r9d, dword [rsp + 0x58]
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
mov rcx, 0xffffffffffffffff
call fcn.14000166d
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400012b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1400013a0
test eax, eax
jne 0x1400012c9
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, dword [section..data]
lea r10, [0x140003020]
mov r9, qword [0x140003020]
xor edx, edx
shl ecx, 0xd
xor ecx, dword [section..data]
mov eax, ecx
shr eax, 0x11
xor eax, ecx
mov ecx, eax
shl ecx, 5
xor ecx, eax
mov eax, ecx
mov dword [section..data], ecx
div r9d
mov eax, edx
add rax, rax
cmp ebx, dword [r10 + rax*8 + 8]
jne 0x140001340
mov r8d, ecx
shl ecx, 0xd
xor edx, edx
xor ecx, r8d
mov eax, ecx
shr eax, 0x11
xor eax, ecx
mov ecx, eax
shl ecx, 5
xor ecx, eax
mov eax, ecx
mov r8d, ecx
div r9d
mov eax, edx
add rax, rax
cmp ebx, dword [r10 + rax*8 + 8]
je 0x140001310
mov dword [section..data], ecx
mov eax, edx
add rax, rax
mov rax, qword [r10 + rax*8 + 0x10]
add rsp, 0x20
pop rbx
ret
Function at 0x14000449c
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140055110]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ebx, edx
mov r15, rcx
mov edx, 1
call fcn.1400096d4
mov edi, 2
xor edx, edx
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor r13d, r13d
mov r14, rax
test rax, rax
je 0x14000463d
mov r8d, edi
lea rdx, [0x140057088]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140004634
test ebx, ebx
je 0x14000454a
sub ebx, 1
je 0x140004529
cmp ebx, 1
jne 0x14000462b
mov qword [rsp + 0x50], r13
lea rax, str.LocalSystem
or edx, 0xffffffff
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rax
mov r8d, edx
jmp 0x1400045fd
lea rdi, [r15 + 0xaa8]
mov r8d, 0x400
mov rdx, rdi
mov ecx, 0x66
call fcn.140003968
lea rbx, [r15 + 0x2a8]
mov r8d, 0x400
mov rdx, rbx
mov ecx, 0x65
call fcn.140003968
mov qword [rbp - 0x39], rbx
lea r8, [rbp - 0x39]
mov ebx, 1
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
xor eax, eax
mov dword [rbp - 0x19], ebx
xorps xmm0, xmm0
mov qword [rbp + 0x1b], rax
movups xmmword [rbp - 0x15], xmm0
mov dword [rbp + 0x23], eax
lea r8, [rbp - 0x31]
lea rax, [0x140039d58]
mov dword [rbp - 9], r13d
mov qword [rbp - 0x11], rax
lea edx, [rbx + 7]
lea rax, [rbp - 0x19]
mov dword [rbp - 0x15], ebx
movups xmmword [rbp - 5], xmm0
mov rcx, rsi
mov qword [rbp - 0x29], rax
movups xmmword [rbp + 0xb], xmm0
mov qword [rbp - 1], r13
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x21], r13
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov qword [rsp + 0x50], rdi
lea r8d, [rbx + 1]
mov qword [rsp + 0x48], r13
or edx, 0xffffffff
mov qword [rsp + 0x40], r13
lea rax, str.SENS
mov r9d, edx
mov qword [rsp + 0x38], rax
mov rcx, rsi
lea rax, str.ProfSvc_Group
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140014260
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140004de8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140004e0e
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140008090
jmp 0x140004e79
cmp byte [0x1400582e8], 0
jne 0x140004e52
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004e42
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400582e0], rax
jmp 0x140004e49
mov rax, qword [0x1400582e0]
mov byte [0x1400582e8], 1
jmp 0x140004e59
mov rax, qword [0x1400582e0]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140004e73
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [0x1400396f8]
jmp 0x140004e79
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140004f28
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140055110]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov rax, r8
mov esi, edx
mov qword [rsp + 0x30], r14
mov rbp, rcx
mov dword [rsp + 0x28], 6
xor r9d, r9d
mov dword [rsp + 0x40], r14d
lea r8d, [r14 + 1]
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov rcx, rax
mov ebx, 0x80004005
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140004fbb
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004fb2
cmp dword [rsp + 0x40], esi
cmove ebx, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140014260
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140005080
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140055110]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x50], 0
mov edi, 0x20019
cmp ecx, 1
mov r14, rdx
lea eax, [rdi + 6]
cmove edi, eax
call fcn.1400066b4
test al, al
je 0x1400050ce
movups xmm0, xmmword [0x140039f80]
jmp 0x1400050d5
movups xmm0, xmmword [0x140039f90]
mov r9d, 2
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400051a5
xor esi, esi
mov dword [rbp - 0x28], 0x20
xor edx, edx
jmp 0x140005187
xor r9d, r9d
mov dword [rsp + 0x28], edi
lea rdx, [rbp - 0x28]
mov dword [rsp + 0x20], 2
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov qword [rbp - 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x14000517e
and dword [rbp - 0x40], 0
lea rcx, [rbp - 0x44]
and dword [rbp - 0x48], 0
lea r9, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
lea rdx, str.Inst
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x44], 4
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005174
cmp dword [rbp - 0x48], eax
jne 0x14000519c
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x50], 0
inc esi
mov edx, esi
lea r8, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140005109
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rax, qword [rbp - 0x50]
test rax, rax
jne 0x1400051d6
test r14, r14
je 0x1400051d6
lea rax, [rbp - 0x50]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140014260
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret