joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009210
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x20], 0
lea r8, [rbp + 0x20]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor esi, esi
xor r9d, r9d
mov qword [rbp + 0x28], rsi
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x140009270
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x14000925d
mov edi, 0x80004005
jmp 0x14000935b
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14000935b
mov rax, qword [rbp + 0x20]
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryUpdateHealthTools
and dword [rbp - 0x1c], ebx
lea rcx, [rbp - 0x20]
and dword [rbp - 0xc], ebx
xor edx, edx
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x140009249
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x1400092ed
cmp eax, 0x102
je 0x1400092e6
cmp eax, 0xffffffff
jne 0x140009253
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x1400092d2
xor edi, edi
jmp 0x140009362
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x140009362
jmp 0x14000935b
mov edi, 0x800705b4
jmp 0x14000935b
lea r9, [rbp + 0x28]
lea r8, [0x140036fb0]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000aeb4
mov rsi, qword [rbp + 0x28]
test eax, eax
cmovs rsi, rdi
call fcn.14000b05c
mov edi, eax
test eax, eax
jns 0x14000931d
mov ecx, eax
jmp 0x14000935d
xor ecx, ecx
call fcn.140009f80
lea r9, [rsi + 1]
mov dword [rsp + 0x20], 8
lea r8, [0x140036fb0]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000b918
mov edi, eax
test eax, eax
jns 0x140009350
mov ecx, eax
call fcn.140009f60
mov ecx, edi
call fcn.140009f80
test edi, edi
jns 0x140009362
mov ecx, edi
call fcn.140009f60
test rbx, rbx
je 0x140009370
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test edi, edi
jns 0x140009382
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, edi
call fcn.140009624
test rbx, rbx
je 0x140009390
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14000939f
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov rbx, qword [rsp + 0x80]
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000aeb4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, r9
lea rax, [rbp - 8]
mov r14, r8
mov qword [r11 - 0x38], rax
xor edi, edi
xor ebx, ebx
and qword [rbp - 8], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rdi + 1]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000af30
xor esi, esi
mov rdi, qword [rbp - 8]
and qword [rbp - 8], rbx
mov ecx, esi
call fcn.140009f80
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14000af25
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
and qword [rbp - 8], rbx
test esi, esi
jns 0x14000af4b
mov ecx, esi
jmp 0x14000b006
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x14000af03
mov ecx, esi
call fcn.140009f60
jmp 0x14000af0b
and dword [rbp + 0x20], ebx
lea rax, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x14000af85
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x14000af29
test rbx, rbx
jne 0x14000afc3
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x14000afb9
mov ebx, eax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14000af4e
mov esi, 0x8007000e
jmp 0x14000af29
mov esi, 0x8000ffff
jmp 0x14000af29
cmp dword [rbp - 0x10], 0xb
je 0x14000afd3
mov esi, 0x8007000d
jmp 0x14000af29
xor r14d, r14d
cmp dword [rbp + 0x20], 8
je 0x14000afed
mov esi, 0x8007000d
mov ecx, esi
mov r14d, esi
call fcn.140009f60
jmp 0x14000aff3
mov rax, qword [rbx]
mov qword [r15], rax
mov ecx, r14d
call fcn.140009f80
mov esi, r14d
test r14d, r14d
jns 0x14000b00b
mov ecx, r14d
call fcn.140009f60
mov ecx, esi
call fcn.140009f80
test rbx, rbx
je 0x14000b02b
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test rdi, rdi
je 0x14000b039
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14000b918
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r9
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
xor ebx, ebx
lea rax, [r11 + 8]
and qword [r11 + 8], rbx
mov rsi, r8
xor r8d, r8d
mov qword [r11 - 0x18], rax
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b9bd
xor edi, edi
mov rbx, qword [rsp + 0x40]
and qword [rsp + 0x40], 0
mov ecx, edi
call fcn.140009f80
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000b983
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
and qword [rsp + 0x40], 0
test edi, edi
js 0x14000b9ea
xor ecx, ecx
call fcn.140009f80
mov eax, dword [rsp + 0x60]
mov r9d, 0xb
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x14000b9d8
xor edi, edi
jmp 0x14000b9f1
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14000b95b
mov ecx, edi
call fcn.140009f60
jmp 0x14000b966
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14000b9f1
mov ecx, edi
call fcn.140009f60
mov ecx, edi
call fcn.140009f80
test rbx, rbx
je 0x14000ba06
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d908
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movabs rax, 0xcbf29ce484222325
mov rdx, r8
lea r9, [r8 + 4]
cmp r9, r8
sbb r8, r8
not r8
and r8d, 4
cmp rdx, r9
ja 0x14000d977
movzx ecx, byte [rdx]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc rdx
mov rcx, rdx
sub rcx, r10
cmp rcx, r8
jne 0x14000d955
mov r8, qword [rsi + 0x30]
and r8, rax
mov rdi, qword [rsi + 8]
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdx, qword [rcx + rax*8]
cmp rdi, rdx
je 0x14000d9ed
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14000d9ed
mov rdi, qword [rdi + 8]
mov eax, dword [rdi + 0x10]
cmp dword [r10], eax
jne 0x14000d99d
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.14000a110
mov edx, 0x38
mov rcx, rbx
call fcn.14002c338
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14000db15
mov qword [rsp + 0x80], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14000da2a
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
add r8, r8
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14000da4a
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000da79
cmp rax, rdi
jne 0x14000da55
mov qword [rdx + r8*8], rbx
jmp 0x14000da79
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000da79
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14004208c]
test rax, rax
jns 0x14000da9a
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14000daab
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14000db0a
cmp rdx, 0x200
jae 0x14000dac3
shl rdx, 3
jmp 0x14000dad5
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14000dad5
add rdx, rdx
mov rcx, rsi
call fcn.14000b884
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14000db0a
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14000d908
cmp rdi, r15
jne 0x14000daea
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000dc18
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rdi, r8
lea r8, [r11 + 4]
mov rsi, rdx
cmp r8, r11
mov r9, rcx
movabs rax, 0xcbf29ce484222325
mov rbx, r11
sbb r10, r10
not r10
and r10d, 4
cmp r11, r8
ja 0x14000dc79
movzx ecx, byte [rbx]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rbx
mov rcx, rbx
sub rcx, r11
imul rax, rdx
cmp rcx, r10
jne 0x14000dc57
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14000dcb1
cmp qword [rcx + rdx*8], rdi
jne 0x14000dca6
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14000dcaa
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14000dcbe
cmp qword [rcx + rdx*8], rdi
jne 0x14000dcbe
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [r11 + 8]
dec qword [r9 + 0x10]
call fcn.14000a110
mov edx, 0x38
mov rcx, rdi
call fcn.14002c338
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000dd0c
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140050900]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleFileNameW]
test eax, eax
je 0x14000ddde
mov ebx, 3
xor edx, edx
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x14000ddde
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x70]
and qword [rsp + 0x58], 0
lea r9d, [rbx + 1]
and qword [rsp + 0x50], 0
lea r8, str.Restores_Health_of_Windows_Update_Components
and qword [rsp + 0x48], 0
lea rdx, str.Update_Health_Service
and qword [rsp + 0x40], 0
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
mov rbx, rax
test rax, rax
jne 0x14000ddc5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rbx, rbx
je 0x14000dde4
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
jmp 0x14000dde4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14002c310
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x14000de0c
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140050900]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
xor edx, edx
mov qword [r11 - 0x38], rax
xor ecx, ecx
mov qword [r11 - 0x30], rax
mov esi, 0xe10
mov qword [r11 - 0x28], rax
lea r8d, [rax + 1]
mov dword [rsp + 0x38], eax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x14000dee7
mov r8d, 0x10024
lea rdx, str.Update_Health_Service
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x14000ded0
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x14000dec7
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000deb5
cmp dword [rsp + 0x24], 3
jne 0x14000dec7
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
sub esi, 1
je 0x14000dec7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x14000de9e
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rbx, rbx
je 0x14000dee7
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002c310
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140011798
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [0x140050900]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x1d0]
mov r13, rcx
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x40]
mov r14d, 0x104
mov qword [rsp + 0x38], rax
xor esi, esi
mov edx, r14d
and qword [rsp + 0x20], rsi
mov r12, r9
mov r15, r8
xor edi, edi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x140011940
lea r8, str.kernel32.dll
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.14000281c
mov ebx, eax
test eax, eax
js 0x140011958
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001186c
mov edx, r14d
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x1400118b1
lea r8, str._ntdll.dll
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.14000281c
mov ebx, eax
test eax, eax
js 0x140011958
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r14d, eax
test eax, eax
je 0x1400118b1
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rsi, rax
test rax, rax
je 0x1400118b1
mov r8d, r14d
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1400118bb
mov ebx, 0x8007000e
jmp 0x140011958
mov ebx, 0x8000ffff
jmp 0x140011958
mov r9, rdi
lea rcx, [rsp + 0x40]
mov r8d, r14d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140011940
lea r9, [rsp + 0x28]
mov rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [0x140032d80]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x140011940
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
movzx eax, word [rcx + 0xa]
mov dword [r13], eax
movzx eax, word [rcx + 8]
mov dword [rdx], eax
movzx r8d, word [rcx + 0xe]
mov rax, qword [rsp + 0x38]
mov dword [rax], r8d
cmp r8d, 0x23f0
jae 0x140011933
mov eax, 0xcccccccd
mul r8d
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
jmp 0x140011936
xor r8d, r8d
mov dword [r15], r8d
and dword [r12], 0
jmp 0x140011945
mov ebx, 0x8000ffff
test rdi, rdi
je 0x140011958
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14002c310
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001211c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r11d, r11d
lea r8, [0x140000000]
mov r9, rdx
test rdx, rdx
jne 0x14001214d
mov r9, r8
not r9
mov rdx, r9
mov rcx, r8
call fcn.140011e4c
test eax, eax
je 0x140012351
mov edx, 0x40
call fcn.140011e4c
test eax, eax
je 0x140012351
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140012351
movsxd rax, dword [0x14000003c]
cmp rax, r9
jae 0x140012351
lea rcx, [rax + r8]
mov edx, 0x108
call fcn.140011e4c
test eax, eax
je 0x140012351
cmp dword [rcx], 0x4550
jne 0x140012351
movzx eax, word [rcx + 0x14]
cmp rax, r9
jae 0x140012351
add rcx, 0x18
mov edx, 0x10b
cmp word [rcx], dx
jne 0x1400121f6
cmp rax, 0x60
jb 0x140012351
mov edx, 0xe0
call fcn.140011e4c
test eax, eax
je 0x140012351
mov eax, dword [rcx + 0x5c]
add rcx, 0x70
jmp 0x140012227
mov edx, 0x20b
cmp word [rcx], dx
jne 0x140012351
cmp rax, 0x70
jb 0x140012351
mov edx, 0xf0
call fcn.140011e4c
test eax, eax
je 0x140012351
mov eax, dword [rcx + 0x6c]
sub rcx, 0xffffffffffffff80
cmp eax, 2
jbe 0x140012351
mov eax, dword [rcx]
mov edx, dword [rcx + 4]
test rax, rax
je 0x140012351
test rdx, rdx
je 0x140012351
lea rdi, [rax + r8]
test rdi, rdi
je 0x140012351
mov rcx, rdi
call fcn.140011e4c
test eax, eax
je 0x140012351
mov ebp, 0x10
cmp rdx, rbp
jb 0x140012351
movzx ebx, word [rdi + 0xe]
test rbx, rbx
je 0x140012351
movzx ecx, word [rdi + 0xc]
lea r14d, [rbp - 8]
add rcx, 2
mov rsi, r11
lea rcx, [rdi + rcx*8]
test rbx, rbx
je 0x1400122b7
mov rdx, r14
call fcn.140011e4c
test eax, eax
je 0x140012351
cmp word [rcx], bp
je 0x1400122b7
add rcx, r14
inc rsi
cmp rsi, rbx
jb 0x140012297
cmp rsi, rbx
je 0x140012351
mov ebx, dword [rcx + 4]
test ebx, ebx
jns 0x140012339
mov esi, 0x7fffffff
mov rdx, rbp
and rbx, rsi
add rbx, rdi
mov rcx, rbx
call fcn.140011e4c
test eax, eax
je 0x140012351
cmp word [rbx + 0xe], r11w
jne 0x1400122ef
cmp word [rbx + 0xc], r11w
je 0x140012351
lea rcx, [rbx + 0x10]
mov rdx, r14
call fcn.140011e4c
test eax, eax
je 0x140012351
mov ebx, dword [rcx + 4]
test ebx, ebx
jns 0x140012339
and rbx, rsi
mov rdx, rbp
add rbx, rdi
mov rcx, rbx
call fcn.140011e4c
test eax, eax
je 0x140012351
cmp word [rbx + 0xe], r11w
jne 0x140012329
cmp word [rbx + 0xc], r11w
je 0x140012351
lea rcx, [rbx + 0x10]
mov rdx, r14
call fcn.140011e4c
test eax, eax
je 0x140012351
mov ecx, dword [rcx + 4]
mov rdx, rbp
add rcx, rdi
call fcn.140011e4c
test eax, eax
je 0x140012351
mov r11d, dword [rcx]
add r11, r8
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140012b08
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x270
mov rax, qword [0x140050900]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, qword [rsp + 0x2a8]
lea rdx, str.UpdateHealthTools
mov rdi, rcx
add rcx, 8
call fcn.1400116f0
lea rcx, [rdi + 0x10]
lea rdx, str.CloudManagedUpdate
call fcn.1400116f0
lea rcx, [rdi + 0x18]
lea rdx, str.UpdateHealthTools
call fcn.1400116f0
mov rdx, rbx
lea rcx, [rdi + 0x20]
call fcn.1400116f0
mov rcx, rdi
mov qword [rdi + 0x78], 0xffffffff80000002
call fcn.1400135f4
xor r14d, r14d
mov ebx, eax
test eax, eax
js 0x140012c20
mov rcx, rdi
call fcn.140013530
mov ebx, eax
test eax, eax
js 0x140012c20
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rdx, qword [rdi + 0x20]
lea rax, [rsp + 0x40]
mov rcx, qword [rdi + 0x78]
lea r9d, [r14 + 2]
mov qword [rsp + 0x30], rax
lea r8, str.Endpoint
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x140012c11
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140012bfd
lea rdx, [rsp + 0x50]
test rax, rax
jne 0x140012c18
lea rdx, str.settings_win.data.microsoft.com
mov rcx, rdi
call fcn.1400116f0
mov byte [rdi + 0xa8], 1
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14002c310
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14001320c
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [rcx + 0x20]
lea rax, [rsp + 0x48]
mov rcx, qword [rcx + 0x78]
xor ebx, ebx
and qword [rsp + 0x48], rbx
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x140013250
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400132a2
mov rcx, qword [rsp + 0x48]
lea rdx, str.ETag
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, 0xfffffffd
je 0x140013277
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400132a2
mov rcx, qword [rsp + 0x48]
lea rdx, str.RefreshAfter
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, 0xfffffffd
je 0x1400132a2
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400132b2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret