joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100078848
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x10007889a
test byte [rcx + 0x1c], 1
je 0x10007889a
cmp byte [rcx + 0x19], 5
jb 0x10007889a
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001e400]
mov edx, 0x1f
mov r9d, ebx
call fcn.100036328
mov rcx, qword [0x100152eb8]
cmp ebx, 0x40
je 0x10007899a
mov edx, ebx
mov rcx, rdi
call fcn.1000789d0
cmp ebx, 0x39
je 0x1000788ee
cmp ebx, 0x38
je 0x1000788ee
cmp ebx, 0x37
je 0x1000788ee
cmp ebx, 0x36
je 0x1000788ee
cmp ebx, 0x35
je 0x1000788ee
cmp ebx, 0x34
je 0x1000788ee
cmp ebx, 0x3a
je 0x1000788ee
cmp ebx, 0x3b
je 0x1000788ee
cmp ebx, 0x3c
je 0x1000788ee
cmp ebx, 0x3d
je 0x1000788ee
cmp ebx, 0x3e
je 0x1000788ee
cmp ebx, 0x3f
je 0x1000788ee
cmp ebx, 0x41
jne 0x1000788fb
mov edx, 0x4b
mov rcx, rdi
call fcn.1000789d0
cmp ebx, 0x4b
jne 0x100078993
lea edx, [rbx - 0x12]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0x13]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0x14]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0x15]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0x16]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0x17]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0x11]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0x10]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0xf]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0xe]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0xd]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0xc]
mov rcx, rdi
call fcn.1000789d0
lea edx, [rbx - 0xa]
mov rcx, rdi
call fcn.1000789d0
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000789ba
test byte [rcx + 0x1c], 1
je 0x1000789ba
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001e400]
mov edx, 0x20
call fcn.100034764
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x10008ac20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x10008ac43
mov eax, 0x8000ffff
jmp 0x10008ad8e
add rcx, 0x38
call fcn.1000356ac
test eax, eax
js 0x10008ad8e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov byte [rbx + 0x60], 1
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x10008ac8d
cmp byte [rbx + 0x60], al
je 0x10008ac83
lea rcx, [rbx + 0x38]
mov byte [rbx + 0x60], al
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.10004f5fc
jmp 0x10008ad8e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
jne 0x10008accb
call fcn.10004f5fc
mov edx, 0x2710
mov rcx, rbx
mov edi, eax
call fcn.10008b1d0
test eax, eax
jns 0x10008ad8c
test edi, edi
cmovns edi, eax
jmp 0x10008ad8c
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.10008ada4
mov esi, eax
test eax, eax
jns 0x10008acff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x2710
mov rcx, rbx
call fcn.10008b1d0
mov eax, esi
jmp 0x10008ad8e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
je 0x10008aca5
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.10008ada4
mov edi, eax
test eax, eax
jns 0x10008ad46
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x2710
mov rcx, rbx
call fcn.10008b1d0
jmp 0x10008ad8c
lea rax, [rbx + 8]
lea r8, [0x10008b2b8]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
test rax, rax
je 0x10008aca5
mov rcx, qword [rbx + 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10008ad8c
call fcn.10004f5fc
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x10008e880
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x10008e8d2
test byte [rcx + 0x1c], 1
je 0x10008e8d2
cmp byte [rcx + 0x19], 5
jb 0x10008e8d2
mov eax, dword [rdi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001e390]
mov edx, 0x2c
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.10006c5c8
mov rcx, qword [rbx]
and dword [rsp + 0x60], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x30]
lea rdx, [0x100022e28]
xor r8d, r8d
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x10008e91f
mov eax, dword [rsp + 0x30]
sub eax, 4
neg eax
sbb ebx, ebx
and ebx, 0xd
mov r10, qword [0x100152eb8]
cmp r10, rsi
je 0x10008e960
test byte [r10 + 0x1c], 2
je 0x10008e960
cmp byte [r10 + 0x19], 5
jb 0x10008e960
mov eax, dword [rsp + 0x60]
mov rcx, qword [r10 + 0x10]
lea r8, [0x10001e390]
mov edx, 0x2d
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.10003b338
mov r10, qword [0x100152eb8]
test ebx, ebx
jne 0x10008e9a2
cmp r10, rsi
je 0x10008e995
test byte [r10 + 0x1c], 2
je 0x10008e995
cmp byte [r10 + 0x19], 4
jb 0x10008e995
mov eax, dword [rsp + 0x60]
mov r9d, dword [rdi]
mov rcx, qword [r10 + 0x10]
lea edx, [rbx + 0x2e]
lea r8, [0x10001e390]
mov dword [rsp + 0x20], eax
call fcn.10003b338
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
mov r10, qword [0x100152eb8]
cmp r10, rsi
je 0x10008e9e1
test byte [r10 + 0x1c], 1
je 0x10008e9e1
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x10008e9e1
mov ecx, dword [rdi]
lea r8, [0x10001e390]
mov edx, 0x2f
mov dword [rsp + 0x20], ecx
mov rcx, qword [r10 + 0x10]
mov r9d, ebx
call fcn.10003b338
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1000db7c4
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
xor esi, esi
mov r12, r9
mov r13, r8
mov r14, rdx
mov rbp, rcx
lea rdi, [0x100152eb8]
test rcx, rcx
je 0x1000db9ab
test rdx, rdx
je 0x1000db9ab
test r8, r8
je 0x1000db9ab
test r9, r9
je 0x1000db9ab
and dword [rax - 0x58], esi
lea r8d, [rsi + 0x28]
lea rcx, [rax - 0x50]
xor edx, edx
call sub.msvcrt.dll_memset
and qword [rsp + 0x30], rsi
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 0x800
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
mov ebx, eax
bts ebx, 0x1c
test ebx, ebx
js 0x1000db93b
lea rcx, [rsp + 0x40]
mov rdx, rbp
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0xb0]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x40]
lea r8d, [rsi + 1]
mov edx, 0x80000000
mov qword [rsp + 0x20], rax
call sub.ADVAPI32.dll_LsaLookupNames2
mov ebx, eax
bts ebx, 0x1c
test ebx, ebx
js 0x1000db92d
mov rcx, qword [rsp + 0xb0]
cmp dword [rcx], 7
je 0x1000db911
cmp dword [rcx], 8
je 0x1000db911
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1000db90a
mov r8, qword [rsp + 0xb0]
mov rdx, rax
mov ecx, ebx
mov r8, qword [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1000db8f0
mov rsi, rdi
xor edi, edi
xor ebx, ebx
jmp 0x1000db8f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdi, [0x100152eb8]
jmp 0x1000db916
mov ebx, 0x8007000e
jmp 0x1000db901
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0xb0]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x30]
call sub.ADVAPI32.dll_LsaClose
test ebx, ebx
jns 0x1000db971
mov rcx, qword [0x100152eb8]
cmp rcx, rdi
je 0x1000db9b7
test byte [rcx + 0x1c], 2
je 0x1000db9b7
cmp byte [rcx + 0x19], 2
jb 0x1000db9b7
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc98]
mov r9, rbp
call fcn.10009b2f4
jmp 0x1000db9b0
mov r9, r12
mov r8, rsi
mov rdx, r13
mov rcx, r14
call fcn.1000dba24
mov ebx, eax
test eax, eax
jns 0x1000db9b0
mov rcx, qword [0x100152eb8]
cmp rcx, rdi
je 0x1000db9b7
test byte [rcx + 0x1c], 2
je 0x1000db9b7
cmp byte [rcx + 0x19], 2
jb 0x1000db9b7
mov edx, 0x32
mov dword [rsp + 0x20], eax
jmp 0x1000db95c
mov ebx, 0x80004003
mov rcx, qword [0x100152eb8]
test rsi, rsi
je 0x1000db9cc
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x100152eb8]
test ebx, ebx
jns 0x1000db9fd
cmp rcx, rdi
je 0x1000db9fd
test byte [rcx + 0x1c], 2
je 0x1000db9fd
cmp byte [rcx + 0x19], 2
jb 0x1000db9fd
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc98]
mov edx, 0x33
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10009b2f4
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000df634
Capabilities:
Get routing table

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rdx
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
mov eax, 5
cmp rcx, rdx
je 0x1000df686
test byte [rcx + 0x1c], 1
je 0x1000df686
cmp byte [rcx + 0x19], al
jb 0x1000df686
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x3c]
lea r8, [0x10001dc88]
mov r9, r14
call fcn.100034814
xor esi, esi
or eax, 0xffffffff
xor edi, edi
and dword [rsp + 0x58], esi
mov qword [rsp + 0x60], rdi
mov r12d, eax
mov ebp, eax
lea r13d, [rsi + 2]
test r14, r14
jne 0x1000df6ae
mov ebx, 0x80004003
jmp 0x1000df78e
mov ecx, 0x3c
call fcn.10011b8d4
mov rsi, rax
test rax, rax
jne 0x1000df6ca
mov ebx, 0x8007000e
jmp 0x1000df78e
lea rdx, [rsp + 0x58]
xor r8d, r8d
mov rcx, rax
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x1000df70c
mov rcx, rsi
call sub.msvcrt.dll_free
mov ecx, dword [rsp + 0x58]
call fcn.10011b8d4
mov rsi, rax
test rax, rax
je 0x1000df6c0
lea rdx, [rsp + 0x58]
xor r8d, r8d
mov rcx, rax
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
je 0x1000df71e
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1000df78e
cmp dword [rsi], edi
jbe 0x1000df747
mov ecx, dword [rsi]
lea rax, [rsi + 8]
cmp dword [rax - 4], edi
jne 0x1000df73d
cmp dword [rax], edi
jne 0x1000df73d
cmp dword [rax + 0x20], ebp
jae 0x1000df73d
mov r12d, dword [rax + 0xc]
mov ebp, dword [rax + 0x20]
add rax, 0x38
sub rcx, 1
jne 0x1000df728
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov ecx, r13d
call fcn.1000e6f88
mov rdi, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
js 0x1000df78e
mov rdx, rdi
test rdi, rdi
je 0x1000df789
cmp dword [rdx + 4], r12d
je 0x1000df7fc
cmp r12d, 0xffffffff
jne 0x1000df780
cmp dword [rdx + 0x68], 1
je 0x1000df7fc
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x1000df76a
mov ebx, 0x80004005
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000df7e3
test byte [rcx + 0x1c], 1
je 0x1000df7e3
movzx eax, byte [rcx + 0x19]
test ebx, ebx
mov edx, 5
cmovns r13d, edx
cmp eax, r13d
jl 0x1000df7e3
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc88]
mov edx, 0x42
mov r9d, ebx
call fcn.100036328
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rdx, qword [rdx + 0x18]
test rdx, rdx
je 0x1000df789
cmp qword [rdx + 0x10], 0
je 0x1000df81b
cmp dword [rdx + 0x18], 0
jle 0x1000df81b
cmp dword [rdx + 0x18], 0x80
jbe 0x1000df821
mov rdx, qword [rdx + 8]
jmp 0x1000df800
movsxd r8, dword [rdx + 0x18]
mov rdx, qword [rdx + 0x10]
mov rcx, r14
call sub.msvcrt.dll_memcpy
jmp 0x1000df78e
Function at 0x1000e0638
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov esi, edx
mov r12, rcx
mov qword [rsp + 0x38], rcx
lea r14, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000e06bb
test byte [rcx + 0x1c], 1
je 0x1000e06b3
mov r13d, 5
cmp byte [rcx + 0x19], r13b
jb 0x1000e06c1
lea edx, [r13 + 0xa]
mov r9d, esi
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x1000e06c1
mov r13d, 5
jmp 0x1000e06c1
mov r13d, 5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [r12 + 0x80], esi
and dword [r12 + 0x84], 0
cmp qword [r12 + 0x78], 0
je 0x1000e0840
cmp qword [r12 + 0x38], 0
jne 0x1000e06f3
xor eax, eax
jmp 0x1000e0721
xor eax, eax
cmp dword [r12 + 0x40], eax
jbe 0x1000e071f
mov rdx, qword [r12 + 0x30]
mov rcx, rdx
cmp qword [rcx], 0
jne 0x1000e0719
inc eax
add rcx, 8
cmp eax, dword [r12 + 0x40]
jb 0x1000e0704
jmp 0x1000e071f
mov rax, qword [rdx + rax*8]
jmp 0x1000e0721
xor eax, eax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1000e0748
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x30]
call fcn.10004d38c
mov rcx, qword [rax]
and dword [rcx], 0
cmp qword [rsp + 0x30], 0
jne 0x1000e072b
lea rcx, [0x100001eb0]
cmp qword [r12 + 0x78], 0
cmovne rcx, qword [r12 + 0x78]
mov r8d, 0x40
lea rdx, [rsp + 0x50]
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
jne 0x1000e078a
mov ecx, 0x8007000e
call fcn.100036264
int3
mov edx, 0x10000
mov r8d, 1
mov rcx, rax
call fcn.1000f1fd4
mov qword [r12 + 0x28], rax
test rax, rax
je 0x1000e0808
mov rcx, rax
call fcn.1000f29a0
test eax, eax
je 0x1000e07f2
mov edx, esi
mov rcx, r12
call fcn.1000e0120
mov esi, eax
test eax, eax
js 0x1000e081c
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1000e03ec]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1000e081c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000e081c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1000e081c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
jmp 0x1000e0845
mov esi, 0x80004005
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000e0882
test byte [rcx + 0x1c], 1
je 0x1000e0882
movzx edx, byte [rcx + 0x19]
mov eax, 2
test esi, esi
cmovns eax, r13d
cmp edx, eax
jl 0x1000e0882
mov edx, 0x10
mov r9d, esi
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.10011b980
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1000e08c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, rcx
lea rsi, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e0924
test byte [rcx + 0x1c], 1
je 0x1000e0924
mov edx, 0x11
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100034764
lea rcx, [0x100151100]
mov rax, qword [0x100151100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
xor edi, edi
cmp qword [r12 + 0x28], rdi
je 0x1000e0a25
lea rdx, [rsp + 0x40]
mov ebx, 0x104
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000e0965
cmp eax, ebx
jb 0x1000e0981
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x1000e0a25
lea r9, [0x100026488]
lea r8, [rsp + 0x40]
lea rdx, [0x1000264b0]
lea rcx, [rsp + 0x20]
call fcn.100039d9c
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e09d4
mov ebx, 2
test byte [rcx + 0x1c], bl
je 0x1000e09d9
cmp byte [rcx + 0x19], 4
jb 0x1000e09d9
lea edx, [rbx + 0x10]
mov r9, qword [rsp + 0x20]
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100034788
jmp 0x1000e09d9
mov ebx, 2
mov r9d, ebx
mov r8d, 0xa
mov rdx, qword [rsp + 0x20]
mov rcx, qword [r12 + 0x28]
call fcn.1000f25e0
test eax, eax
jne 0x1000e0a0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1000e0a11
and qword [r12 + 0x28], 0
jmp 0x1000e0a2a
mov ebx, 2
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e0a67
test byte [rcx + 0x1c], 1
je 0x1000e0a67
movzx eax, byte [rcx + 0x19]
mov edx, 5
test edi, edi
cmovns ebx, edx
cmp eax, ebx
jl 0x1000e0a67
mov edx, 0x13
mov r9d, edi
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1000e0a88
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10011b980
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1000e285c
Capabilities:
Modify service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov dword [rax + 0x10], edx
push r13
sub rsp, 0x60
mov rdi, rcx
mov rcx, qword [0x100152eb8]
lea r12, [0x100152eb8]
lea r13, [0x10001dc48]
cmp rcx, r12
je 0x1000e28d5
test byte [rcx + 0x1c], 1
je 0x1000e28af
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r8, r13
call fcn.100034764
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000e28d5
test byte [rcx + 0x1c], 2
je 0x1000e28d5
cmp byte [rcx + 0x19], 4
jb 0x1000e28d5
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
mov r8, r13
lea r9d, [rdx - 0x1a]
call fcn.100036328
mov edx, 1
mov rcx, rdi
call fcn.1000e2b40
mov ebx, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000e2910
test byte [rcx + 0x1c], 2
je 0x1000e2910
cmp byte [rcx + 0x19], 4
jb 0x1000e2910
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r9d, eax
mov r8, r13
call fcn.100036328
cmp ebx, 1
jne 0x1000e29cf
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x78]
lea edx, [rbx + 2]
mov dword [rsp + 0x78], ebx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ebx, eax
cmp eax, 1
je 0x1000e295e
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000e29cf
test byte [rcx + 0x1c], 2
je 0x1000e29cf
cmp byte [rcx + 0x19], 2
jb 0x1000e29cf
mov edx, 0x1d
jmp 0x1000e29c0
mov rcx, qword [rdi + 0x10]
xor eax, eax
or edx, 0xffffffff
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8d, [rax + 2]
mov r9d, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp eax, 1
je 0x1000e29cf
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000e29cf
test byte [rcx + 0x1c], 2
je 0x1000e29cf
cmp byte [rcx + 0x19], 4
jb 0x1000e29cf
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.100036328
mov rcx, rdi
call fcn.1000e2d7c
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000e2a03
test byte [rcx + 0x1c], 1
je 0x1000e2a03
cmp byte [rcx + 0x19], 5
jb 0x1000e2a03
mov rcx, qword [rcx + 0x10]
mov edx, 0x1f
mov r9d, ebx
mov r8, r13
call fcn.100036328
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x1000e2a24
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x1000e2a64
test byte [rcx + 0x1c], 1
je 0x1000e2a64
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc48]
mov edx, 0x20
call fcn.100034764
xor edx, edx
mov rcx, rdi
call fcn.1000e2b40
mov ebx, eax
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e2aa0
test byte [rcx + 0x1c], 2
je 0x1000e2aa0
cmp byte [rcx + 0x19], 4
jb 0x1000e2aa0
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc48]
mov edx, 0x21
mov r9d, eax
call fcn.100036328
cmp ebx, 1
jne 0x1000e2af0
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
cmp eax, 1
je 0x1000e2af0
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e2af0
test byte [rcx + 0x1c], 2
je 0x1000e2af0
cmp byte [rcx + 0x19], 4
jb 0x1000e2af0
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc48]
mov edx, 0x22
mov r9d, eax
call fcn.100036328
mov rcx, rdi
call fcn.1000e2d7c
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000e2b28
test byte [rcx + 0x1c], 1
je 0x1000e2b28
cmp byte [rcx + 0x19], 5
jb 0x1000e2b28
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc48]
mov edx, 0x23
mov r9d, ebx
call fcn.100036328
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000e52b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rbp, r8
mov r12, rdx
mov r13, rcx
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000e530e
test byte [rcx + 0x1c], 1
je 0x1000e530e
cmp byte [rcx + 0x19], 5
jb 0x1000e530e
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4a
mov r9, r12
call fcn.100034788
mov rcx, qword [r13]
xor r14d, r14d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
mov esi, r14d
mov dword [rsp + 0x34], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r14d
jne 0x1000e5373
cmp dword [rsp + 0x88], 1
je 0x1000e5366
cmp dword [rsp + 0x88], 2
je 0x1000e5366
lea ebx, [r14 + 0xd]
jmp 0x1000e5373
mov esi, dword [rsp + 0x30]
mov ebx, r14d
shr esi, 1
mov dword [rsp + 0x34], esi
mov rdi, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rdi, rax
je 0x1000e53b1
test byte [rdi + 0x1c], 2
je 0x1000e53b1
cmp byte [rdi + 0x19], 4
jb 0x1000e53b1
mov rcx, qword [rdi + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4b
mov r9d, ebx
call fcn.100036328
mov rdi, qword [0x100152eb8]
cmp ebx, r14d
jne 0x1000e54b5
mov rax, qword [rbp]
mov ecx, 1
lea edx, [rsi + 2]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or ecx, eax
jge 0x1000e53da
mov rcx, rbp
call fcn.100036140
mov r8, qword [rbp]
lea r9, [rsp + 0x34]
mov rdx, r12
mov rcx, r13
call fcn.10004f370
mov ebx, eax
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x1000e5427
test byte [rcx + 0x1c], 2
je 0x1000e5427
cmp byte [rcx + 0x19], 4
jb 0x1000e5427
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4c
mov r9d, eax
call fcn.100036328
mov eax, ebx
neg eax
sbb ecx, ecx
neg ecx
dec ecx
cmp ecx, 0xffffffff
jne 0x1000e5453
mov rdi, qword [rbp]
cmp rdi, r14
jne 0x1000e5444
mov ecx, r14d
jmp 0x1000e5458
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r14d
jl 0x1000e54aa
mov rax, qword [rbp]
cmp ecx, dword [rax - 0xc]
jg 0x1000e54aa
mov dword [rax - 0x10], ecx
mov rax, qword [rbp]
movsxd rcx, ecx
mov word [rax + rcx*2], r14w
mov rdi, qword [0x100152eb8]
cmp rdi, rsi
je 0x1000e54f3
test byte [rdi + 0x1c], 2
je 0x1000e54bc
cmp byte [rdi + 0x19], 4
jb 0x1000e54bc
mov r9, qword [rbp]
mov rcx, qword [rdi + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4d
call fcn.100034788
mov rdi, qword [0x100152eb8]
jmp 0x1000e54bc
mov ecx, 0x80070057
call fcn.100036264
int3
lea rsi, [0x100152eb8]
cmp rdi, rsi
je 0x1000e54f3
test byte [rdi + 0x1c], 1
je 0x1000e54f3
movzx edx, byte [rdi + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1000e54f3
mov rcx, qword [rdi + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4e
mov r9d, ebx
call fcn.100036328
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret