joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1097bf4
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.0109c460
nop
cmp dword [0x010bcbfc], 1
je 0x1097b7f
mov dword [0x010bcbf8], 1
mov byte [0x010bcbb4], dil
test ebx, ebx
jne 0x1097b6b
mov rcx, qword [0x010c84d0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x010c84c8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1097b58
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1097b58
mov rcx, qword [rbx]
test rcx, rcx
je 0x1097b56
call rcx
jmp 0x1097b3e
lea rdx, [0x010114c0]
lea rcx, [0x010114a8]
call fcn.01097930
lea rdx, [0x010114d0]
lea rcx, [0x010114c8]
call fcn.01097930
nop
test edi, edi
je 0x1097b8d
mov ecx, 8
call fcn.0109c32c
test edi, edi
jne 0x1097bb5
mov dword [0x010bcbfc], 1
lea ecx, [rdi + 8]
call fcn.0109c32c
mov ecx, r12d
call fcn.010978b4
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x1097acc

Function at 0x1097c04
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1097acc
Function at 0x1097ca4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, [0x010b91a0]
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x1097cd7
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x1097cc7
cmp edi, 0x17
jae 0x1097e85
mov ebp, 3
mov ecx, ebp
call fcn.0109cb6c
cmp eax, 1
je 0x1097e3d
mov ecx, ebp
call fcn.0109cb6c
test eax, eax
jne 0x1097d0d
cmp dword [0x010b9170], 1
je 0x1097e3d
cmp ebx, 0xfc
je 0x1097e85
lea rbx, [0x010bcc00]
mov ebp, 0x314
lea r8, [0x01011c70]
mov rcx, rbx
mov rdx, rbp
call fcn.0109c0f8
test eax, eax
je 0x1097d50
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01098fa0
lea rdx, [0x010bcc19]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x010bcd1d], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1097da1
lea r8, [0x01011c58]
lea rcx, [0x010bcc19]
mov edx, 0x2fb
call fcn.0109c0f8
test eax, eax
je 0x1097da1
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01098fa0
lea r8, [0x010bcc19]
mov rdx, rbp
mov rcx, rbx
call fcn.0109cad8
test eax, eax
je 0x1097dcc
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01098fa0
lea r8, [0x01011c50]
mov rdx, rbp
mov rcx, rbx
call fcn.0109cad8
test eax, eax
je 0x1097df7
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01098fa0
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.0109cad8
test eax, eax
je 0x1097e26
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01098fa0
lea rdx, [0x01011c28]
mov r8d, 0x12010
mov rcx, rbx
call fcn.0109c8a4
jmp 0x1097e85
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x1097e85
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x1097e85
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret

Function at 0x1098528
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
jne 0x1098550
xor eax, eax
jmp 0x109859c
cmp word [rdi], bx
je 0x1098567
add rax, 2
cmp word [rax], bx
jne 0x1098555
add rax, 2
cmp word [rax], bx
jne 0x1098555
sub eax, edi
add eax, 2
movsxd rbp, eax
mov rcx, rbp
call fcn.0109666c
cmp rax, rbx
mov rsi, rax
je 0x1098590
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.0109a340
mov rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1098d18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1098d62
cmp rcx, 0xffffffffffffffff
je 0x1098d62
cmp word [rcx], 0x5a4d
jne 0x1098d5a
cmp dword [rcx + 0x3c], edx
jl 0x1098d5a
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1098d5a
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1098d62
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1098f1f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x010b9180]
jne 0x10965aa
rol rcx, 0x10
test cx, 0xffff
jne 0x10965a6
repz ret
ror rcx, 0x10
jmp 0x1098e78
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x010bd1e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x010bd2d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1098efd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x010bd1e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1098f1f
mov rax, qword [rsp + 0x88]
mov qword [0x010bd2d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x010bd278], rax
mov rax, qword [0x010bd2d8]
mov qword [0x010bd150], rax
mov rax, qword [rsp + 0x90]
mov qword [0x010bd260], rax
mov dword [0x010bd140], 0xc0000409
mov dword [0x010bd144], 1
mov rax, qword [0x010b9180]
mov qword [rsp + 0x68], rax
mov rax, qword [0x010b9188]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x01011c90]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1098fa0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x109900b
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x109902b
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x01011ca0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret

Function at 0x109c894
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x649b5d99
jmp 0x100709c
xor rcx, rcx
jmp 0x1001195
Function at 0x109c8a4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.010988a0
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
cmp qword [0x010bd968], rbp
mov rdi, rax
jne 0x109c9d7
lea rcx, [0x01011e58]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rsi, rax
jne 0x109c903
xor eax, eax
jmp 0x109cab7
lea rdx, [0x01011e48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x109c8fc
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x01011e38]
mov rcx, rsi
mov qword [0x010bd968], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x01011e20]
mov rcx, rsi
mov qword [0x010bd970], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x010bd978], rax
call fcn.0109796c
test eax, eax
je 0x109c98a
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01098fa0
cmp dword [rsp + 0x88], 2
jne 0x109c9d7
lea rdx, [0x01011e00]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
test rax, rax
mov qword [0x010bd988], rax
je 0x109c9d7
lea rdx, [0x01011de8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x010bd980], rax
mov rcx, qword [0x010bd980]
cmp rcx, rdi
je 0x109ca69
cmp qword [0x010bd988], rdi
je 0x109ca69
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rsi, rax
je 0x109ca34
mov rcx, qword [0x010bd988]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x109ca34
test byte [rsp + 0x40], 1
jne 0x109ca69
lea rcx, [rsp + 0x30]
call fcn.010979b8
test eax, eax
je 0x109ca56
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01098fa0
cmp dword [rsp + 0x30], 4
jb 0x109ca63
bts ebx, 0x15
jmp 0x109ca9d
bts ebx, 0x12
jmp 0x109ca9d
mov rcx, qword [0x010bd970]
cmp rcx, rdi
je 0x109ca9d
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rbp, rax
je 0x109ca9d
mov rcx, qword [0x010bd978]
cmp rcx, rdi
je 0x109ca9d
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x010bd968]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140001180
Capabilities:
Get disk information

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x480
mov rax, qword [0x140020878]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rax, [rsp + 0x260]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x38], 0x105
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0x105
lea rdx, [rsp + 0x260]
lea rcx, [0x1400189b0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140001247
mov r8d, 0x104
mov rdx, qword [rsp + 0x490]
mov ecx, dword [rsp + 0x40]
call fcn.1400014f0
mov rcx, qword [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x1400012a2
call fcn.1400012e0
cmp eax, 1
je 0x14000126e
cmp dword [rsp + 0x4a0], 0
je 0x140001289
lea r8, str.thsnYaVieBoda
mov edx, 0x104
mov rcx, qword [rsp + 0x490]
call fcn.140001850
jmp 0x1400012a2
lea r8, str.TsnIorcAeBoda
mov edx, 0x104
mov rcx, qword [rsp + 0x490]
call fcn.140001850
cmp qword [rsp + 0x498], 0
je 0x1400012c7
mov r8, qword [rsp + 0x498]
mov edx, 0x104
mov rcx, qword [rsp + 0x490]
call fcn.140001850
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140015420
add rsp, 0x480
pop rdi
ret

Function at 0x1400012e0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
sub rsp, 0x38
lea r8, str.GlobalARM_Update_Mutex
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140001312
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001327
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jne 0x140001327
xor eax, eax
jmp 0x14000132c
mov eax, 1
add rsp, 0x38
ret

Function at 0x140001340
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
sub rsp, 0x38
lea r8, str.GlobalAcro_Update_Mutex
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140001372
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001381
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140001381
xor eax, eax
jmp 0x140001386
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400081f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x1400081fe
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], 0
je 0x140008230
mov r8, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call fcn.14000d190
jmp 0x1400082c4
movzx eax, byte [0x140021e60]
test eax, eax
jne 0x140008275
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000826e
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140021e58], rax
mov byte [0x140021e60], 1
cmp qword [0x140021e58], 0
je 0x1400082b1
mov rax, qword [0x140021e58]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 8]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [0x1400185f8]
jmp 0x1400082c4
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x48
ret

Function at 0x1400082d0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x1400082de
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rsp, 0x28
ret
Function at 0x14000ae10
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2a8
mov rax, qword [0x140020878]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x2b0]
call fcn.14000b680
test eax, eax
je 0x14000ae49
mov eax, 1
jmp 0x14000af80
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x14000ae8e
mov rax, qword [rsp + 0x2b0]
add rax, 0x50
xor r9d, r9d
mov r8, rax
lea rdx, str.Couldnt_open_service_manager
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14000af80
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x2b0]
add rax, 0x50
mov rcx, qword [rsp + 0x2b0]
add rcx, 0x50
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea rdx, str.RPCSS
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x14000af65
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, qword [rsp + 0x2b0]
add rax, 0x50
xor r9d, r9d
mov r8, rax
lea rdx, str.Couldnt_create_service
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14000af80
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140015420
add rsp, 0x2a8
ret
Function at 0x14000b3a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x290
mov rax, qword [0x140020878]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov dword [rsp + 0x30], 1
lea rdx, str.InstallPath
lea rcx, str.SoftwareAdobeAcrobat_Distiller_
call fcn.140001b90
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000b515
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x208
mov dword [rsp + 0x44], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
test rax, rax
je 0x14000b515
lea rdx, str.Adist64.dll
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea rcx, [rsp + 0x70]
call fcn.140011c60
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000b515
lea rdx, str.IsAcrobatProInstalled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000b4c1
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
call qword [0x1400185f8]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000b4d2
mov dword [rsp + 0x30], 0
jmp 0x14000b50a
lea rdx, str.IsAcrobatElementsInstalled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14000b50a
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
call qword [0x1400185f8]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140015420
add rsp, 0x290
pop rdi
ret
Function at 0x14000bbd0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x288
mov rax, qword [0x140020878]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x70]
call fcn.140011850
mov qword [rsp + 0x58], 0
mov eax, 8
imul rax, rax, 0
lea rcx, [rsp + 0x70]
mov qword [rsp + rax + 0x60], rcx
mov rax, qword [rsp + 0x290]
cmp dword [rax + 0x278], 0
je 0x14000bcc8
mov rax, qword [rsp + 0x290]
add rax, 0x50
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000bcc6
mov eax, 8
imul rax, rax, 0
lea rax, [rsp + rax + 0x60]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov dx, 4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x14000bcd3
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140015420
add rsp, 0x288
ret

Function at 0x14000cd90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x14000cda8
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shl rax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14000ce0a
mov eax, dword [rsp + 0x34]
jmp 0x14000ce94
cmp dword [rsp + 0x38], 1
je 0x14000ce1f
cmp dword [rsp + 0x38], 2
je 0x14000ce1f
mov eax, 0xd
jmp 0x14000ce94
cmp qword [rsp + 0x60], 0
je 0x14000ce7d
cmp dword [rsp + 0x30], 0
je 0x14000ce69
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
test rax, rax
jne 0x14000ce60
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x60]
movzx eax, word [rcx + rax*2 - 2]
test eax, eax
je 0x14000ce67
mov eax, 0xd
jmp 0x14000ce94
jmp 0x14000ce7d
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rsp + 0x60]
mov word [rdx + rax], cx
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000cea0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x140020878]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140002f00
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x58]
call fcn.14000c370
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x14000cf25
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x58]
call fcn.140003af0
mov eax, dword [rsp + 0x48]
jmp 0x14000cfe3
mov dword [rsp + 0x44], 0x100
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000cfb2
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.14000cea0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x14000cfa5
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x58]
call fcn.140003af0
mov eax, dword [rsp + 0x4c]
jmp 0x14000cfe3
mov dword [rsp + 0x44], 0x100
jmp 0x14000cf2d
lea rcx, [rsp + 0x58]
call fcn.1400074e0
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.1400081f0
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x58]
call fcn.140003af0
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140015420
add rsp, 0x298
ret

Function at 0x14000d190
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x14000d237
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14000d1d6
mov eax, 1
jmp 0x14000d25c
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000d235
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x50]
call qword [0x1400185f8]
jmp 0x14000d25c
jmp 0x14000d257
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 0
je 0x14000d257
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000d25c
mov eax, 1
add rsp, 0x68
ret