joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003e30
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140003e5e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140005bc0
cmp byte [0x14007dd30], 0
jne 0x140003ea9
lea rcx, [0x140055e38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140003e99
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14007dd30], 1
mov qword [0x14007dd28], rax
jmp 0x140003eb0
mov rax, qword [0x14007dd28]
mov byte [0x14007dd30], 1
jmp 0x140003eb0
mov rax, qword [0x14007dd28]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140003ecf
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140005c34
lea rcx, [0x140055e38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je case.default.0x140005c4f
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140005c4f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140005c4f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
in eax, dx
cmp al, 0xd7
sahf
or eax, 0xa60f2b03
pop rdx
movsb byte [rdi], byte [rsi]
fimul word [rsi - 0x18dd1082]
invalid
movabs al, byte [0xe370c153f497a047]
test al, 0xdf
pop rbp
sbb byte [rcx], ch
mov r12, cs
xor al, 0x8f
sti
imul ecx, dword [rsi + 0xf], 0x5c9cd066
xor al, 0x16
fimul dword [rbx - 0x64dde9cd]
push rsi
jle 0x1400ce675
and byte [rsp + rsi*8], bh
xchg esp, eax
lodsb al, byte [rsi]
push 0xffffffffffffff8d
xor cl, byte [rdi + rdi*8 - 0x14]
loop 0x1400ce5c1
mov ebp, 0x4eff4ca8
cmc
xor byte [rcx + 0x11], ah
loop 0x1400ce69c
invalid
jl 0x1400ce685
invalid
xor edi, dword [rbx - 0x62]
push rdi
mov esi, 0xe9afa8fc
xchg ebp, eax
pop rdx
and dword [rsi], ecx
cmpsb byte [rsi], byte [rdi]
push rcx
out dx, eax
int3
jnp 0x1400ce668
push rsi
sbb al, 0x6c
adc byte [rdx - 0x72], al
cli
pop rdx
popfq
Function at 0x1400047c0
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0x590
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov rdi, rcx
call fcn.140004ab0
test eax, eax
je 0x1400047f1
mov eax, 1
jmp 0x1400048d9
lea rdx, [rsp + 0x71]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400049d1
cmp eax, 0x104
je 0x1400049d1
lea ecx, [rax + 1]
add eax, 2
mov byte [rsp + 0x70], 0x22
mov byte [rsp + rcx + 0x70], 0x22
cmp eax, 0x106
jae 0x140004a1a
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x5a8], rbx
mov byte [rsp + rax + 0x70], 0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x1400048f2
lea rdx, [rsp + 0x180]
mov r8d, 0x400
mov ecx, 0xd80a
call fcn.140002880
test eax, eax
jne 0x1400048b8
lea r8, str.Could_not_open_Service_Manager
lea rcx, [rsp + 0x180]
mov edx, 0x400
call fcn.14003d4e8
test eax, eax
je 0x1400048b8
cmp eax, 0xc
je 0x1400049ee
cmp eax, 0x16
je 0x1400049e3
cmp eax, 0x22
je 0x1400049e3
cmp eax, 0x50
jne 0x1400049d8
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rbx, qword [rsp + 0x5a8]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x590
pop rdi
ret
xor ecx, ecx
lea rax, str.RPCSS
add rdi, 0x68
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r9d, 0xf01ff
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], SafeArrayLock
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
test rax, rax
jne 0x1400049b5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x180]
mov r8d, 0x400
mov ecx, 0xd80b
call fcn.140002880
test eax, eax
jne 0x1400049aa
lea r8, str.Could_not_start_service
lea rcx, [rsp + 0x180]
mov edx, 0x400
call fcn.14003d4e8
test eax, eax
je 0x1400049aa
cmp eax, 0xc
je 0x140004a0f
cmp eax, 0x16
je 0x140004a04
cmp eax, 0x22
je 0x140004a04
cmp eax, 0x50
jne 0x1400049f9
xor r9d, r9d
mov r8, rdi
jmp 0x1400048bf
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x1400048d1
xor eax, eax
jmp 0x1400048d9
mov ecx, 0x80004005
call fcn.140003630
int3
mov ecx, 0x80070057
call fcn.140003630
int3
mov ecx, 0x8007000e
call fcn.140003630
int3
mov ecx, 0x80004005
call fcn.140003630
int3
mov ecx, 0x80070057
call fcn.140003630
int3
mov ecx, 0x8007000e
call fcn.140003630
int3
call fcn.14003d0d4
int3
Function at 0x140004d40
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x170
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r9, rdx
mov edx, pe_nt_image_headers64
mov rbx, rcx
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 1]
mov qword [rsp + 0x20], rax
call fcn.14003e1bc
cmp dword [rbx + 0x18c], 0
lea rax, [rsp + 0x60]
mov byte [rsp + 0x15f], 0
mov qword [rsp + 0x50], rax
jne 0x140004db0
lea rcx, [rsp + 0x60]
call fcn.14003df58
lea rdx, [rbx + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rbx, rax
test rax, rax
je 0x140004e06
xor ecx, ecx
mov r9d, 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], r9w
lea edx, [r9 + 3]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x170
pop rbx
ret

Function at 0x140005a70
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
call fcn.140005000
mov ebx, eax
test eax, eax
jne 0x140005b87
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140005b61
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140005a70
mov ebx, eax
test eax, eax
jne 0x140005b87
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140005b10
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140005b76
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x50], ebp
call fcn.140003e30
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140005b97
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14003eed0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005bc0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140003e5e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140005bc0
cmp byte [0x14007dd30], 0
jne 0x140003ea9
lea rcx, [0x140055e38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140003e99
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14007dd30], 1
mov qword [0x14007dd28], rax
jmp 0x140003eb0
mov rax, qword [0x14007dd28]
mov byte [0x14007dd30], 1
jmp 0x140003eb0
mov rax, qword [0x14007dd28]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140003ecf
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140005c34
lea rcx, [0x140055e38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je case.default.0x140005c4f
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140005c4f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140005c4f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
in eax, dx
cmp al, 0xd7
sahf
or eax, 0xa60f2b03
pop rdx
movsb byte [rdi], byte [rsi]
fimul word [rsi - 0x18dd1082]
invalid
movabs al, byte [0xe370c153f497a047]
test al, 0xdf
pop rbp
sbb byte [rcx], ch
mov r12, cs
xor al, 0x8f
sti
imul ecx, dword [rsi + 0xf], 0x5c9cd066
xor al, 0x16
fimul dword [rbx - 0x64dde9cd]
push rsi
jle 0x1400ce675
and byte [rsp + rsi*8], bh
xchg esp, eax
lodsb al, byte [rsi]
push 0xffffffffffffff8d
xor cl, byte [rdi + rdi*8 - 0x14]
loop 0x1400ce5c1
mov ebp, 0x4eff4ca8
cmc
xor byte [rcx + 0x11], ah
loop 0x1400ce69c
invalid
jl 0x1400ce685
invalid
xor edi, dword [rbx - 0x62]
push rdi
mov esi, 0xe9afa8fc
xchg ebp, eax
pop rdx
and dword [rsi], ecx
cmpsb byte [rsi], byte [rdi]
push rcx
out dx, eax
int3
jnp 0x1400ce668
push rsi
sbb al, 0x6c
adc byte [rdx - 0x72], al
cli
pop rdx
popfq
Function at 0x140005c70
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x70
movzx r14d, dl
mov rsi, rcx
call fcn.140007440
test eax, eax
jne 0x140005c97
mov eax, 0x80004005
add rsp, 0x70
pop r14
pop rsi
pop rbx
ret
mov rcx, qword [0x14007dca0]
lea rax, str.APPID
mov edx, 0x65
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea rax, [0x140056400]
lea r9, [rsp + 0x50]
movdqu xmmword [rsp + 0x60], xmm0
lea r8d, [rdx - 0x64]
mov qword [rsp + 0x58], rax
call fcn.140007930
test eax, eax
js 0x140005e13
xor ebx, ebx
lea r8, str.AppID
lea rcx, [rsp + 0x50]
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
call fcn.140005000
test eax, eax
je 0x140005d1a
mov ecx, eax
call fcn.140002730
mov ebx, eax
jmp 0x140005dfe
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0xa0]
lea rdx, str.250DD19F_6E7F_4BA3_9E1B_69E6CDC52F30
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], rbx
mov dword [rsp + 0x20], ebx
mov rdi, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140005ddf
mov rdi, qword [rsp + 0xa8]
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test r14b, r14b
je 0x140005de8
lea rcx, [rsi + 0x68]
test rcx, rcx
je 0x140005dcc
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x140005da0
inc eax
lea rdx, str.LocalService
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rsi
call fcn.1400047c0
test eax, eax
jne 0x140005de8
mov ebx, 0x80004005
jmp 0x140005de8
mov ecx, eax
call fcn.140002730
mov ebx, eax
test rdi, rdi
je 0x140005df6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x90]
cmp qword [rsp + 0x50], 0
je 0x140005e11
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x70
pop r14
pop rsi
pop rbx
ret
Function at 0x140006f40
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x140006f80
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
mov r11, rcx
test r8, r8
jne 0x140006f9b
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x140006fa5
inc eax
mov ecx, eax
add r8d, eax
add rdx, rcx
cmp eax, 1
jne 0x140006fa1
mov rcx, qword [r11]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret
Function at 0x1400070a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor r15d, r15d
mov rdi, rcx
mov r14d, edx
lea rcx, [rsp + 0x50]
lea r8, str.AppID
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x60], r15
call fcn.140005000
mov ebx, eax
test eax, eax
je 0x14000710a
mov dword [rdi + 0x17c], eax
jmp 0x140007262
mov rdx, qword [rsp + 0x50]
lea r8, str.250DD19F_6E7F_4BA3_9E1B_69E6CDC52F30
lea rcx, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x48], r15
call fcn.140005000
mov ebx, eax
test eax, eax
jne 0x14000724a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
lea rdx, str.LocalService
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, eax
test eax, eax
jne 0x1400071b2
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
jbe 0x14000718e
lea ecx, [rbx + 0xd]
jmp 0x1400071b2
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400071a7
cmp byte [rsp + rax + 0x8f], r15b
je 0x1400071af
mov ecx, 0xd
jmp 0x1400071b2
mov byte [rsp + 0x90], r15b
mov ecx, r15d
test ecx, ecx
mov eax, r15d
mov edx, 1
cmove eax, edx
mov dword [rdi + 0x18c], eax
test eax, eax
je 0x14000720e
lea rax, [rdi + 0x68]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x68], rax
lea rax, [0x1400082b0]
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x70], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x140007206
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x17c], eax
mov ebx, dword [rdi + 0x17c]
jmp 0x140007250
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x140007239
cmp eax, 0x80010106
jne 0x140007250
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14000723d
jmp 0x140007250
mov byte [rdi + 0x62], 1
mov edx, r14d
mov rcx, rdi
call fcn.140009b00
mov ebx, eax
mov dword [rdi + 0x17c], eax
cmp qword [rsp + 0x38], r15
je 0x140007262
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x50], r15
je 0x140007274
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14003eed0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1b0
pop r15
pop r14
pop rdi
ret
Function at 0x140007810
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x78
call fcn.140007440
test eax, eax
jne 0x140007827
mov eax, 0x80004005
add rsp, 0x78
ret
mov qword [rsp + 0x70], rbx
xor ebx, ebx
lea r8, str.AppID
lea rcx, [rsp + 0x38]
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
call fcn.140005000
test eax, eax
je 0x14000786c
mov ecx, eax
call fcn.140002730
mov ebx, eax
jmp 0x140007903
mov rdx, qword [rsp + 0x38]
lea r8, str.250DD19F_6E7F_4BA3_9E1B_69E6CDC52F30
lea rcx, [rsp + 0x20]
mov r9d, 0x20006
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], rbx
call fcn.140005000
test eax, eax
je 0x1400078a3
mov ecx, eax
call fcn.140002730
jmp 0x1400078ee
mov rcx, qword [rsp + 0x20]
lea rdx, str.LocalService
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [0x14007dca0]
lea rax, str.APPID
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
xor r8d, r8d
mov qword [rsp + 0x50], rax
lea rax, [0x140056400]
lea r9, [rsp + 0x50]
lea edx, [r8 + 0x65]
mov qword [rsp + 0x58], rax
call fcn.140007930
cmp qword [rsp + 0x20], 0
mov ebx, eax
je 0x140007903
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x38], 0
je 0x140007916
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x140007f60
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x14007dcc9], 0
mov edi, edx
mov rbx, rcx
je 0x140007f86
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rbx
call fcn.1400054b0
cmp al, 1
jne 0x140007fb6
mov edx, edi
mov rcx, rbx
call fcn.1400070a0
mov edi, eax
jmp 0x140007fba
mov edi, dword [rsp + 0x40]
cmp dword [rbx + 0x18c], 0
jne 0x140007fcf
cmp byte [rbx + 0x62], 0
je 0x140007fcf
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400088c0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x14007a8d0]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [0x140056122]
mov r14d, r9d
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, 1
lea r8, str.GlobalLNiPodServiceMutex
xor edi, edi
mov ecx, edx
mov rsi, rax
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x14000891b
mov rcx, rax
lea ebx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14003dcbc
mov edx, ebx
mov rcx, rax
call fcn.140003ee0
test eax, eax
je 0x140008938
xor eax, eax
jmp 0x140008a62
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0x70], r15
call fcn.14002c6e0
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [0x14007ddc0]
mov r15d, eax
call fcn.140009630
lea r8, str.ASiPodServiceMutex
mov edx, 1
xor ecx, ecx
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x38]
test eax, eax
lea rax, [rsp + 0x38]
mov edx, 1
mov ebx, edi
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
setne bl
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov rcx, qword [rsp + 0x28]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea r8, str.GlobalLNiPodServiceMutex
lea rcx, [rsp + 0x20]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x140008a07
test eax, eax
jne 0x140008a07
lea rcx, [0x14007ddc0]
mov edx, r14d
call fcn.140007f60
mov edi, eax
lea rcx, [0x14007ddc0]
mov edx, r12d
call fcn.140009440
mov r12, qword [rsp + 0xa8]
test eax, eax
je 0x140008a2e
lea rcx, [0x14007ddc0]
call fcn.140009e00
test rbp, rbp
je 0x140008a3c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0xa0]
test rsi, rsi
je 0x140008a52
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov r15, qword [rsp + 0x70]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14003eed0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140009370
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
xor ebx, ebx
xorps xmm0, xmm0
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x70], rbx
lea r8d, [rbx + 1]
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140009200
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 4
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edi, eax
test eax, eax
jns 0x1400093ee
lea rcx, str._CIpodServiceModule::InitializeSecurity_____FAILED_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call fcn.14003cc98
mov rcx, qword [rsp + 0x58]
call fcn.14003d184
mov rcx, qword [rsp + 0x60]
call fcn.14003d184
mov rcx, qword [rsp + 0x68]
call fcn.14003d184
mov rcx, qword [rsp + 0x70]
call fcn.14003d184
mov rbx, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x80
pop rdi
ret