joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002a50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor ebx, ebx
mov rdi, rdx
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWARE
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002b8c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
lea r9d, [rbx + 1]
lea rdx, str.FLEXlm_License_Manager
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002b81
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.Service
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x40], 0xc7
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Borrow
lea rcx, [rsp + 0x50]
mov r8d, 6
call fcn.140020718
test ebx, ebx
jne 0x140002b66
test eax, eax
je 0x140002b66
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x50]
sub rdi, rcx
nop
movzx ecx, byte [rax]
lea rax, [rax + 1]
mov byte [rdi + rax - 1], cl
test cl, cl
jne 0x140002b50
mov eax, 1
jmp 0x140002b8e
movups xmm0, xmmword [str.Flexlm_Service_1]
mov eax, 1
movups xmmword [rdi], xmm0
movzx ecx, byte [0x1400fcf60]
mov byte [rdi + 0x10], cl
jmp 0x140002b8e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x140002bb0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
lea rax, [rsp + 0x30]
xor byte [rax - 0x73], cl
adc eax, 0xfa2ec
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002c52
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, str.lmtools_LM_A_DISABLE_ENV
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002c36
cmp dword [rsp + 0x68], ebx
setne bl
mov rcx, qword [rsp + 0x30]
mov dword [0x140136df0], ebx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x140136df0], 0
jne 0x140002cc6
jmp 0x140002c58
mov dword [0x140136df0], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rdx, [0x1400fced0]
mov rcx, rax
call fcn.14000cadc
mov rbx, rax
test rax, rax
je 0x140002cc6
test rbx, rbx
je 0x140002ca0
lea rdx, str.disablelicpath
mov rcx, rbx
call fcn.14003dae4
test eax, eax
je 0x140002cbc
lea rdx, str._disablelicpath
mov rcx, rbx
call fcn.14003dae4
test eax, eax
je 0x140002cbc
lea rdx, [0x1400fced0]
xor ecx, ecx
call fcn.14000cadc
mov rbx, rax
test rax, rax
jne 0x140002c75
add rsp, 0x40
pop rbx
ret
mov dword [0x140136df0], 1
add rsp, 0x40
pop rbx
ret

Function at 0x140002dc0
Capabilities:
Set registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov dword [0x140136df0], edx
mov rcx, qword [rcx + 0x130]
xor ebx, ebx
mov edi, edx
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x80], rbx
call fcn.140028340
lea rax, [rsp + 0x88]
lea r9d, [rbx + 1]
lea rdx, str.SOFTWARE
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002ec9
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x78]
lea r9, [0x1400fca4c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
lea rdx, str.FLEXlm_License_Manager
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
xor eax, eax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140002ebb
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
test edi, edi
setne bl
lea rdx, str.lmtools_LM_A_DISABLE_ENV
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
add byte [rax], al
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140002ead
add byte [rbp + 0x480c75c0], al
lea ecx, str.all_is_well
lea rcx, str.all_is_well
call fcn.140056910
mov rcx, qword [rbx + rcx*4 + 0xabbc3]
add byte [rax], al
cdq
idiv ebx
mov ebx, eax
test r11, rbx
jne 0x140002e9c
fmul dword [rcx - 0x7b]
invalid
mov cl, 0x1c
movabs eax, dword [0xe283d08b00409004]
jp 0x18090af64
nop
invalid
rol byte [rbx - 0x6d75f01e], 1
adc byte [rax - 0x24ccffc0], 0x8a
nop
add byte [rbx], sil
invalid
mov bl, cl
add byte [rbx], dh
Function at 0x140005360
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
lea rcx, [rsp + 0x48]
xor edx, edx
mov dword [rsp + 0x30], 0xff
call fcn.140026c40
mov rcx, qword [rdi + 0xf0]
xor esi, esi
lea rdx, [rsp + 0x48]
mov ebp, esi
mov r14d, esi
call fcn.140027fa0
lea rcx, [rsp + 0x48]
xor edx, edx
call fcn.140027040
lea rdx, str.SOFTWAREFLEXlm_License_Manager_s
lea rcx, [rsp + 0x60]
mov r8, rax
call fcn.14000ca3c
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400055ac
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
lea rdx, str.cmdlineparams
xor r8d, r8d
mov qword [rsp + 0x298], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0xea
je 0x1400055a4
lea rdx, [0x1400fced0]
lea rcx, [rsp + 0x160]
call fcn.14000cadc
mov rbx, rax
test rax, rax
jne 0x1400054a0
mov rcx, qword [rdi + 0xf8]
xor edx, edx
call fcn.140028340
mov rcx, qword [rdi + 0x100]
xor edx, edx
call fcn.140028340
mov rcx, qword [rdi + 0x108]
xor edx, edx
call fcn.140028340
jmp 0x1400055a4
lea rdx, [0x1400fd3d8]
xor r8d, r8d
mov rcx, rbx
call fcn.14002a750
test eax, eax
jne 0x1400054c0
test r14d, r14d
jne 0x1400054d9
lea edx, [rax + 1]
jmp 0x1400054c7
test r14d, r14d
jne 0x1400054d9
xor edx, edx
mov rcx, qword [rdi + 0xf8]
call fcn.140028340
mov r14d, 1
lea rdx, [0x1400fd3e0]
xor r8d, r8d
mov rcx, rbx
call fcn.14002a750
test eax, eax
jne 0x14000558a
lea rdx, [0x1400fced0]
xor ecx, ecx
call fcn.14000cadc
mov rbx, rax
test rax, rax
je 0x1400055a4
lea rdx, str.lmdown
xor r8d, r8d
mov rcx, rax
call fcn.14002a750
test eax, eax
jne 0x14000553d
test ebp, ebp
jne 0x140005554
mov rcx, qword [rdi + 0x100]
lea edx, [rax + 1]
call fcn.140028340
mov ebp, 1
jmp 0x14000559b
test ebp, ebp
jne 0x140005554
mov rcx, qword [rdi + 0x100]
xor edx, edx
call fcn.140028340
mov ebp, 1
lea rdx, str.lmremove
xor r8d, r8d
mov rcx, rbx
call fcn.14002a750
test eax, eax
jne 0x140005573
test esi, esi
jne 0x14000558a
lea edx, [rax + 1]
jmp 0x140005579
test esi, esi
jne 0x14000558a
xor edx, edx
mov rcx, qword [rdi + 0x108]
call fcn.140028340
mov esi, 1
lea rdx, [0x1400fced0]
xor ecx, ecx
call fcn.14000cadc
mov rbx, rax
test rbx, rbx
jne 0x1400054a0
mov rbx, qword [rsp + 0x298]
lea rcx, [rsp + 0x48]
call fcn.140026cc0
or eax, 0xffffffff
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000c9f0
mov rbp, qword [rsp + 0x2a0]
add rsp, 0x270
pop r14
pop rdi
pop rsi
ret
Function at 0x1400055e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor edi, edi
mov rbx, rdx
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWARE
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400056f1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
lea r9d, [rdi + 1]
lea rdx, str.FLEXlm_License_Manager
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400056e6
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.Service
xor r8d, r8d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x40], 0xc7
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movzx ecx, byte [rsp + 0x50]
test eax, eax
cmovne ecx, edi
mov byte [rsp + 0x50], cl
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x50]
sub rbx, rdx
nop dword [rax + rax]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rbx + rcx - 1], dl
test dl, dl
jne 0x1400056d0
mov eax, 1
jmp 0x1400056f3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x140005720
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
lea rcx, [rsp + 0x38]
xor edx, edx
call fcn.140026c40
mov rcx, qword [rbx + 0xf8]
mov byte [rsp + 0x50], 0
call fcn.140027e10
test eax, eax
invalid
je 0x140005786
lea rax, [rsp + 0x50]
dec rax
nop word [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x140005770
movsd xmm0, qword [str._local]
movsd qword [rax], xmm0
mov rcx, qword [rbx + 0x100]
call fcn.140027e10
test eax, eax
je 0x1400057f1
lea rcx, [rsp + 0x50]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400057a0
movzx eax, word [0x1400fd410]
movsd xmm0, qword [str._x_lmdown]
mov edx, 0x3f1
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
movzx eax, byte [0x1400fd412]
add byte [rax - 0x74b7f5bf], cl
mov esi, dword [rax - 0x1000000]
adc eax, 0xf6ebb
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
lea rdx, str.Stop_Server_Disabled__Check_Lmdown_functionality_in_Advanced_Settings
jmp 0x140005818
mov rcx, qword [rbx + 0xb0]
mov edx, 0x3f1
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
lea rdx, str.Stop_Server_Enabled
mov rcx, rbx
call fcn.1400256c0
mov rcx, qword [rbx + 0x108]
call fcn.140027e10
test eax, eax
je 0x14000585f
lea rcx, [rsp + 0x50]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005840
movsd xmm0, qword [0x1400fd430]
mov eax, dword [0x1400fd438]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0xf0]
lea rdx, [rsp + 0x38]
call fcn.140027fa0
lea rcx, [rsp + 0x38]
xor edx, edx
call fcn.140027040
lea rdx, str.SOFTWAREFLEXlm_License_Manager_s
lea rcx, [rsp + 0x150]
mov r8, rax
call fcn.14000ca3c
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x150]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005957
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400058d0
mov rcx, qword [rsp + 0x30]
inc eax
lea rdx, str.cmdlineparams
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 0x100]
call fcn.140027e10
test eax, eax
je 0x140005957
cmp dword [rbx + 0x14c], 0
je 0x140005957
mov rcx, qword [rbx + 0xb0]
mov edx, 0x3f1
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
lea rdx, str.Forced_Stop_Server_Enabled__Use_in_case_of_borrow_ONLY
mov rcx, rbx
call fcn.1400256c0
lea rcx, [rsp + 0x38]
call fcn.140026cc0
or eax, 0xffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14000c9f0

Function at 0x140005980
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
and al, 0x18
Function at 0x140007080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x1400070a1
mov eax, 0xff
call fcn.140002680
xor byte [rsi], al
jne 0x140007091
pop rsi
pop rbx
ret

Function at 0x140009fb0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov ebp, 1
xor edx, edx
xor ecx, ecx
mov r8d, ebp
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x14000a036
lea r8d, [rbx + 4]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x14000a02d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14000a024
cmp dword [rsp + 0x24], 4
cmove ebx, ebp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14000a590
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2210
call fcn.14000c990
sub rsp, rax
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x2200], rax
mov rdi, rcx
mov r14, rdx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], 0
call fcn.14000cbf0
mov rdx, r14
mov rcx, rdi
call fcn.140009c70
mov rdx, r14
mov rcx, rdi
mov dword [rdi + 0x140], eax
call fcn.140009d10
mov rcx, qword [rdi + 0xf0]
mov edx, eax
mov dword [rdi + 0x144], eax
call fcn.1400283b0
mov edx, dword [rdi + 0x140]
lea rcx, [rdi + 0x130]
call fcn.140009dd0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x380]
mov rcx, rax
call fcn.14000b6c0
mov rcx, qword [rdi + 0xf8]
lea rdx, [rsp + 0x270]
call fcn.140028400
mov rcx, qword [rdi + 0x100]
lea rdx, [rsp + 0x380]
call fcn.140028400
xor r15d, r15d
cmp byte [rsp + 0x50], r15b
jne 0x14000a766
lea rcx, [rdi + 0x158]
xor edx, edx
mov qword [rsp + 0x40], r15
call fcn.140026dd0
test eax, eax
je 0x14000a713
lea r9, [rsp + 0x40]
lea rcx, [0x140104828]
xor r8d, r8d
xor edx, edx
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x14000a713
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], r15b
call fcn.14000cbf0
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x160]
mov qword [rsp + 0x30], r15
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rsp + 0x160]
lea rcx, [rdi + 0x158]
call fcn.140026d40
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rdi + 0x158]
xor edx, edx
call fcn.140026e10
test eax, eax
je 0x14000a766
lea rcx, [rdi + 0x158]
xor edx, edx
call fcn.140027040
lea r9, [0x1400fe694]
lea rdx, str._s_s_s_s
mov r8, rax
lea rax, str.debug.log
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, str.lmgrd
mov qword [rsp + 0x20], rax
call fcn.14000ca3c
mov rcx, qword [rdi + 0x108]
lea rdx, [rsp + 0x50]
call fcn.140028400
mov edx, dword [rdi + 0x140]
lea rcx, [rdi + 0x130]
call fcn.140009dd0
lea r8, [rdi + 0x148]
lea rdx, [rdi + 0x14c]
mov rcx, rax
call fcn.14000b490
mov edx, dword [rdi + 0x148]
mov rcx, qword [rdi + 0x110]
call fcn.140028340
mov edx, dword [rdi + 0x14c]
mov rcx, qword [rdi + 0x118]
call fcn.140028340
mov dword [rdi + 0x128], r15d
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x14000a7ee
mov rcx, qword [rdi + 0x110]
cmp dword [rdi + 0x14c], r15d
je 0x14000a7f5
mov edx, 1
jmp 0x14000a7f7
mov rcx, qword [rdi + 0x118]
xor edx, edx
call fcn.140027dc0
mov edx, dword [rdi + 0x140]
lea rcx, [rdi + 0x130]
mov dword [rdi + 0x150], r15d
call fcn.140009dd0
mov rdx, r14
mov rcx, rax
call fcn.14000b9a0
or eax, 0xffffffff
mov rcx, qword [rsp + 0x2200]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + 0x2250]
add rsp, 0x2210
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b070
Capabilities:
Delete registry value
Delete service

Disassembly:
push rbx
sub rsp, 0x30
mov edx, dword [rcx + 4]
mov rbx, rcx
dec edx
je 0x14000b133
dec edx
jne 0x14000b12b
lea rax, [rsp + 0x48]
lea r9d, [rdx + 1]
lea rdx, str.SOFTWARE
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000b12b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.MicrosoftWindowsCurrentVersionRunServices
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000b115
mov rcx, qword [rsp + 0x40]
lea rdx, [rbx + 0x40c]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x14000b115
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x30
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rdi
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x14000b1f9
lea rdx, [rbx + 0x40c]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x14000b1d7
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14000b1b5
lea r8, str._Service_Error
lea rdx, str.Could_not_Remove_Service
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r8, str.Service_Error
lea rdx, str.Could_not_Locate_service_to_remove
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
Function at 0x14000b210
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r9d, edx
mov ebx, edx
lea rax, [rsp + 0x30]
mov rdi, rcx
lea rdx, str.SOFTWARE
xor r8d, r8d
or r9d, 1
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000b2b1
lea r9, [rdi + 0x40c]
lea r8, str.FLEXlm_License_Manager
lea rdx, [0x1400fea0c]
lea rcx, [rsp + 0x40]
call fcn.14000ca3c
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x14000b2ab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14000b2b3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret

Function at 0x14000b3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
je 0x14000b452
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x14000b402
cmp rax, 0x1ff
jbe 0x14000b42e
add rcx, 0x40c
mov r8d, 0x1ff
call fcn.14000df90
mov byte [rbx + 0x60b], 0
jmp 0x14000b452
sub rcx, rdx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx + rdx + 0x40b], al
test al, al
jne 0x14000b440
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea r8, [rbx + 8]
mov rdx, rbx
cmp eax, 0x80000000
mov rcx, rbx
sbb eax, eax
add eax, 2
mov dword [rbx + 4], eax
call fcn.14000b490
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000b6c0
Function at 0x14000b490
Capabilities:
Query or enumerate registry value
Query service configuration

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor eax, eax
mov r14, r8
mov r15, rdx
mov dword [rdx], eax
mov dword [r8], eax
mov r9d, dword [rcx + 4]
mov rbx, rcx
dec r9d
je 0x14000b5a6
dec r9d
jne 0x14000b59f
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWARE
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x34], 0xc7
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000b59f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, str.MicrosoftWindowsCurrentVersionRunServices
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000b59f
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea rdx, [rbx + 0x40c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x14000b58e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [r14], 1
mov eax, 1
jmp 0x14000b69a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14000b69a
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x138], rsi
lea r8d, [rdx + 1]
mov qword [rsp + 0x130], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x14000b688
lea rdx, [rbx + 0x40c]
mov r8d, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x14000b67f
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x14000b65f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000b65f
mov ebx, dword [rsp + 0x30]
mov qword [rsp + 0x178], rbp
mov ecx, ebx
call fcn.140010258
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x14000b64f
cmp dword [rbp + 4], 2
jne 0x14000b64f
mov dword [r14], 1
mov rcx, rbp
call fcn.140064760
mov rbp, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [r15], 1
mov eax, 1
jmp 0x14000b68a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rsi, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0x140
pop r15
pop r14
pop rbx
ret