joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002581
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x180052de0]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor eax, eax
lea rdi, [rsp + 0x6c]
mov dword [rdi], eax
lea rcx, [rsp + 0x60]
mov qword [rcx], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0xf003f
lea rdx, [0x18003e460]
mov rcx, 0xffffffff80000002
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
jne 0x1800026fd
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.31140
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
jne 0x1800026fd
mov rcx, qword [rsp + 0x58]
lea rax, str.SdkAuthenticatorEapMethod
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x34
lea rdx, str.AuthenticatorFriendlyName
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test eax, eax
jne 0x1800026fd
lea r8, str.EapHostServerMethodSample.dll
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
mov r9d, 0x3c
call fcn.1800024b2
mov esi, eax
test eax, eax
jne 0x1800026fd
mov eax, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, str.AuthenticatorDllPath
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test eax, eax
jne 0x1800026fd
mov rcx, qword [rsp + 0x58]
lea rax, [0x18003e5ac]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea rdx, [0x18003e5b0]
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000270d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18000271d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x50]
call fcn.180002457
movzx edi, si
or edi, 0x80070000
test esi, esi
cmovle edi, esi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180027090
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x18000274b
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x180052de0]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetServicesEapHostMethods311
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x1800027a8
mov rcx, qword [rsp + 0x28]
lea rdx, [0x18003e63c]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1800027b8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx edi, si
or edi, 0x80070000
test esi, esi
cmovle edi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180027090
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1800027dc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rcx
movsxd rax, dword [rcx + 0x3c]
lea r14, [rcx + rax]
mov edx, dword [rcx + rax + 0x50]
mov rcx, qword [rcx + rax + 0x30]
mov r8d, 0x2000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x18000283b
mov edx, dword [r14 + 0x50]
xor esi, esi
xor ecx, ecx
mov r8d, 0x2000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x18000291d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edi, edi
mov r8d, 0x20
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov qword [rax + 8], r15
mov qword [rax + 0x10], rdi
mov qword [rax], rdi
mov edx, dword [r14 + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, r15
mov r8d, 0x1000
mov r9d, 0x40
call rdi
mov edx, dword [r14 + 0x54]
mov rcx, r15
mov r8d, 0x1000
mov r9d, 0x40
call rdi
mov rdi, rax
mov r8d, dword [r14 + 0x54]
add r8d, dword [rbx + 0x3c]
mov rcx, rax
mov rdx, rbx
call fcn.180028b50
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rdi + rax]
mov qword [rsi + 0x18], rcx
mov qword [rdi + rax + 0x30], r15
mov rcx, rbx
mov rdx, r14
mov r8, rsi
call fcn.18000292c
mov rdx, r15
sub rdx, qword [r14 + 0x30]
mov rcx, rsi
call fcn.180002ae4
mov rcx, rsi
call fcn.180002c69
test eax, eax
je 0x180002913
mov rcx, rsi
call fcn.180002dff
mov rax, qword [rsi + 0x18]
mov ebx, dword [rax + 0x28]
test rbx, rbx
je 0x18000291d
add rbx, r15
mov rcx, r15
mov edx, 1
xor r8d, r8d
call rbx
test eax, eax
je 0x180002913
mov dword [rsi], 1
jmp 0x18000291d
mov rcx, rsi
call fcn.1800032ee
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180003464
Capabilities:
Get file size
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov r13, rdx
cmp qword [rdx + 0x18], 0xf
mov rax, rdx
jbe 0x180003484
mov rax, qword [r13]
xor ebx, ebx
mov qword [r13 + 0x10], rbx
mov byte [rax], 0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
mov esi, 0
mov edi, 0
cmp rax, 0xffffffffffffffff
je 0x180003589
xor ebx, ebx
mov rcx, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
lea eax, [r14 - 1]
mov esi, 0
mov edi, 0
cmp eax, 0x63fffff
ja 0x180003589
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov rcx, r12
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, 0
mov edi, 0
test rax, rax
je 0x180003589
mov r15, rax
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x180003584
mov rdi, rax
lea rsi, [rsp + 0x40]
mov rcx, rax
mov edx, r14d
mov r8, rsi
call fcn.18000e700
mov r8d, 0x20
mov rcx, r13
mov rdx, rsi
call fcn.1800010f2
mov ebx, 1
mov rsi, r15
jmp 0x180003589
mov rsi, r15
xor edi, edi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call rdi
mov rcx, r12
call rdi
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140015250
Capabilities:
Connect pipe
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
mov ecx, 0x30
call fcn.140036ce0
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rcx, rax
call fcn.140016300
mov rbx, rax
mov qword [rsp + 0x48], rax
mov ecx, dword [0x140093d40]
mov dword [rsp + 0x40], ecx
inc ecx
mov dword [0x140093d40], ecx
lea rcx, [0x140093d48]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [0x140093d88]
cmp rdx, qword [0x140093d90]
je 0x1400152df
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
add qword [0x140093d88], 0x10
jmp 0x1400152e9
lea r8, [rsp + 0x40]
call fcn.140015bc0
lea rcx, [0x140093d48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x140015316
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
cmp eax, 0x217
jne 0x140015319
mov r9d, edi
movzx eax, byte [0x140093d44]
test al, al
jne 0x1400153fb
test r9d, r9d
jne 0x1400153b4
lea ecx, [r9 + 0x10]
call fcn.140036ce0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140015430]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1400153a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.CreateThread___failed.___d_
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x60]
call fcn.140001630
mov rcx, qword [0x140093d78]
test rcx, rcx
je 0x1400153a6
lea r9, [rsp + 0x60]
lea r8, str.treadstone::TsClientCommandProcessor::WaitAndProcessLoop
lea edx, [rbx + 2]
call fcn.140003290
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140015271
lea r8, str.The_client_could_not_connect_the_pipe.___d_
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x60]
call fcn.140001630
mov rcx, qword [0x140093d78]
test rcx, rcx
je 0x1400153ec
lea r9, [rsp + 0x60]
lea r8, str.treadstone::TsClientCommandProcessor::WaitAndProcessLoop
mov edx, 2
call fcn.140003290
lea rcx, [rsp + 0x40]
call fcn.140015780
jmp 0x140015271
lea rcx, [rsp + 0x40]
call fcn.140015780
mov byte [0x140093d44], 0
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140036cc0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x140016300
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
lea r8d, [r14 + 9]
lea rdx, str..pipe_
call fcn.140015fc0
nop
mov qword [rbx + 0x20], r14
mov qword [rbx + 0x28], r14
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x1400163a6
lea rsi, [rcx + 0xf]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x140016389
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x1e
lea rdx, [0x14007c820]
call fcn.140039270
mov word [rdi + rsi*2], r14w
jmp 0x1400163c3
mov qword [rsp + 0x20], reloc.WS2_32.dll_ntohs
lea r9, [0x14007c820]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.140016140
mov dword [rbx + 0x20], 3
mov dword [rbx + 0x24], 6
mov ecx, 0x28
call fcn.14004bdf8
mov rdi, rax
test rax, rax
je 0x1400164cf
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1400164f1
mov dword [rsp + 0xa8], 0x18
mov dword [rsp + 0xb8], 1
mov qword [rsp + 0xb0], rdi
xor r9d, r9d
lea r8, [rsp + 0xb0]
lea edx, [r9 + 1]
lea rcx, str.D:_A_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GRGWGX___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x140016513
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001644c
mov rcx, qword [rbx]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x3e8
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
mov r9d, 0xff
mov r8d, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x28], rax
mov rcx, rdi
call fcn.14004ae00
cmp qword [rbx + 0x28], 0xffffffffffffffff
je 0x140016535
jmp 0x1400164a2
mov rax, rbx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140036cc0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rdx, str.Allocation_failed.
lea rcx, [rsp + 0x48]
call fcn.1400018b0
lea rdx, [0x14008ce78]
lea rcx, [rsp + 0x48]
call fcn.14003919c
lea rdx, str.SD_initialization_failed.
lea rcx, [rsp + 0x60]
call fcn.1400018b0
lea rdx, [0x14008ce78]
lea rcx, [rsp + 0x60]
call fcn.14003919c
lea rdx, str.DACL_creation_failed.
lea rcx, [rsp + 0x78]
call fcn.1400018b0
lea rdx, [0x14008ce78]
lea rcx, [rsp + 0x78]
call fcn.14003919c
lea rdx, str.Named_pipe_creation_failed.
lea rcx, [rsp + 0x90]
call fcn.1400018b0
lea rdx, [0x14008ce78]
lea rcx, [rsp + 0x90]
call fcn.14003919c
int3
Function at 0x140016cd0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
movzx ebp, r8w
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140016d56
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov edx, 2
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
movzx edx, bp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140036cc0
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x140016d80
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140016560
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140016e29
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140036cc0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x140016e70
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rax, str.ADESv2Svc
mov qword [rcx + 0x10], rax
xor ecx, ecx
mov qword [rbx + 0x38], rcx
mov dword [rbx + 0x18], reloc.WS2_32.dll_recv
mov dword [rbx + 0x1c], 2
mov qword [rbx + 0x20], 0xc5
mov qword [rbx + 0x28], rcx
mov dword [rbx + 0x30], ecx
mov qword [rbx + 8], r8
lea rax, vtable.CServiceInstance.0
mov qword [rbx], rax
mov qword [rbx + 0x68], rcx
mov qword [rbx + 0x70], rcx
mov qword [rbx + 0x78], rcx
mov dword [rbx + 0x50], ecx
mov qword [0x140093d78], r8
mov qword [rbx + 0x60], rcx
xor r9d, r9d
xor r8d, r8d
lea edx, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x140016fee
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x14001700a
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140016f42
lea r9, str.Enter_CServiceInstance
lea r8, str.CServiceInstance
xor edx, edx
call fcn.140003290
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140039940
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, str.PROGRAMDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [0x14007d1a8]
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rsp + 0x40]
call fcn.140006c40
lea r9, [0x14007c6c0]
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rsp + 0x40]
call fcn.140006c40
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140016fc2
lea r9, [rsp + 0x40]
lea r8, str.CServiceInstancecreate_path:
xor edx, edx
call fcn.140003290
mov rcx, rbx
call fcn.1400183f0
nop
jmp 0x140016fd2
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140036cc0
add rsp, 0x260
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rsp + 0x20], eax
lea rdx, [0x14008ca80]
lea rcx, [rsp + 0x20]
call fcn.14003919c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
lea rdx, [0x14008ca80]
lea rcx, [rsp + 0x24]
call fcn.14003919c
int3
Function at 0x1400173d0
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rsi, r8
mov rcx, qword [rcx + 8]
mov edi, edx
test rcx, rcx
je 0x140017413
lea r9, str.OnSessionChange_Enter
xor edx, edx
lea r8, str.OnSessionChange
call fcn.140003290
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140039940
mov r9d, dword [rsi + 4]
lea rdx, str.event_type__x_event_data__x
mov r8d, edi
lea rcx, [rsp + 0x30]
call fcn.140006c40
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140017459
lea r9, [rsp + 0x30]
xor edx, edx
lea r8, str.OnSessionChange
call fcn.140003290
lea eax, [rdi - 1]
cmp eax, 0xa
ja case.default.0x140017476
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1761c]
add rcx, rdx
jmp rcx
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_CONSOLE_CONNECT
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_CONSOLE_DISCONNECT
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_REMOTE_CONNECT
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_REMOTE_DISCONNECT
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400174fa
lea r9, str.WTS_SESSION_LOGON
xor edx, edx
lea r8, str.OnSessionChange
call fcn.140003290
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbx + 8]
mov eax, dword [rsi + 4]
mov dword [0x14008fc90], eax
test rcx, rcx
je 0x14001752c
lea r9, str.Create_BW_Thread
xor edx, edx
lea r8, str.OnStart
call fcn.140003290
xor eax, eax
lea r8, [0x1400195a0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140017559
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 3
mov rcx, rbx
call fcn.140017a80
jmp case.default.0x140017476
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_SESSION_LOGOFF
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_SESSION_LOCK
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_SESSION_UNLOCK
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_SESSION_REMOTE_CONTROL
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_SESSION_CREATE
jmp 0x1400175d2
mov rcx, qword [rbx + 8]
test rcx, rcx
je case.default.0x140017476
lea r9, str.WTS_SESSION_TERMINATE
lea r8, str.OnSessionChange
xor edx, edx
call fcn.140003290
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400175fe
lea r9, str.OnSessionChange_End
xor edx, edx
lea r8, str.OnSessionChange
call fcn.140003290
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140036cc0
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400187e0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14001881b
lea r9, str.Start
lea r8, str.DeleteADESv2REG
xor edx, edx
call fcn.140003290
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareOEMADESV2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018891
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001886d
lea r9, str.Registry_found
lea r8, str.DeleteADESv2REG__RegOpenKey:_SoftwareOEMADESV2
xor edx, edx
call fcn.140003290
lea rdx, str.SoftwareOEMADESV2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1400188c9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140018898
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400188b6
lea r9, [0x14007a9b8]
lea r8, str.DeleteADESv2REG
xor edx, edx
call fcn.140003290
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140036cc0
add rsp, 0x50
pop rbx
ret
lea r8, str.Fail
lea rdx, str.DeleteADESv2REG__RegDeleteKey:_SoftwareOEMADESV2
mov rcx, rbx
call fcn.140016e50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [0x14008ca80]
lea rcx, [rsp + 0x30]
call fcn.14003919c
int3
Function at 0x140018f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140018fc5
lea r9, str.Start
xor edx, edx
lea r8, str.IsConsensus
call fcn.140003290
xor edx, edx
mov dword [rsp + 0x40], 0x30
mov r8d, 0x204
lea rcx, [rsp + 0x44]
call fcn.140039940
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x104
xor esi, esi
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x30], rsi
xor r8d, r8d
lea rdx, str.SoftwareOEMADESV2
mov rcx, 0xffffffff80000002
xor dil, dil
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400190d7
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001903e
lea r9, str.Registry_found
xor edx, edx
lea r8, str.IsConsensus__SoftwareOEMADESV2
call fcn.140003290
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x14007ad98]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400190cc
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001908a
lea r9, [rsp + 0x40]
xor edx, edx
lea r8, str.IsConsensus__Consensus
call fcn.140003290
mov rcx, qword [rbx + 8]
mov eax, 0x31
cmp ax, word [rsp + 0x40]
jne 0x1400190b2
cmp si, word [rsp + 0x42]
jne 0x1400190b2
mov dil, 1
test rcx, rcx
je 0x1400190cc
lea r9, [0x14007ad94]
jmp 0x1400190be
test rcx, rcx
je 0x1400190cc
lea r9, str._1_or_0
lea r8, str.IsConsensus__Consensus
xor edx, edx
call fcn.140003290
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400190f5
lea r9, [0x14007a9b8]
xor edx, edx
lea r8, str.IsConsensus
call fcn.140003290
movzx eax, dil
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140036cc0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret