joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002ac0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbp
push rsi
sub rsp, 0x68
xor eax, eax
mov esi, edx
xor r9d, r9d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rax
lea rax, [r11 + 0x18]
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x50], rax
lea rax, [r11 + 0x20]
mov rbp, rcx
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x180002c4c
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x60], rdi
cmp dword [rsp + 0x98], eax
je 0x180002c22
mov eax, dword [rsp + 0x90]
mov ecx, 0x104
cmp eax, ecx
cmovb eax, ecx
mov dword [rsp + 0x90], eax
lea ecx, [rax + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800034fc
mov rbx, rax
test rax, rax
je 0x180002c48
nop word [rax + rax]
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rbx
inc r8d
add r8, r8
call fcn.1800033a0
mov r9d, dword [rsp + 0x90]
mov r8, rbx
xor edx, edx
mov rcx, rbp
inc r9d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x180002c40
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
or r8d, 0x2001f
call fcn.180002680
mov rdi, rax
test rax, rax
je 0x180002c40
mov edx, esi
mov rcx, rax
call fcn.180002ac0
mov rcx, rdi
test eax, eax
je 0x180002c3b
call fcn.180002700
mov r11, qword [0x180029bd8]
test r11, r11
je 0x180002bfd
test esi, esi
je 0x180002bfd
xor r9d, r9d
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call r11
jmp 0x180002c09
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x180002c40
dec dword [rsp + 0x98]
jne 0x180002b70
mov rcx, rbx
call fcn.180003320
mov eax, 1
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x60]
add rsp, 0x68
pop rsi
pop rbp
ret
call fcn.180002700
mov rcx, rbx
call fcn.180003320
xor eax, eax
jmp 0x180002c27
xor eax, eax
add rsp, 0x68
pop rsi
pop rbp
ret
Function at 0x180002c60
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov esi, r9d
mov rbp, r8
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x180002c9f
mov r8d, r9d
or r8d, 0x2001f
call fcn.180002680
mov rbx, rax
jmp 0x180002ca2
mov rbx, rcx
test rbx, rbx
je 0x180002d39
mov rcx, rbx
test rbp, rbp
je 0x180002cd4
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x180002d2c
cmp rbx, rdi
je 0x180002ccd
mov rcx, rbx
call fcn.180002700
mov eax, 1
jmp 0x180002d3b
mov edx, esi
call fcn.180002ac0
test eax, eax
je 0x180002d2c
cmp rbx, rdi
je 0x180002cec
mov rcx, rbx
call fcn.180002700
mov rax, qword [0x180029bd8]
test rax, rax
je 0x180002d15
test esi, esi
je 0x180002d15
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call rax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x180002d3b
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x180002d3b
cmp rbx, rdi
je 0x180002d39
mov rcx, rbx
call fcn.180002700
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov r9d, dword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x180002c60
mov r8, rdx
xor edx, edx
jmp 0x180002e70

Function at 0x180002e80
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov esi, r9d
mov rbp, r8
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x180002c9f
mov r8d, r9d
or r8d, 0x2001f
call fcn.180002680
mov rbx, rax
jmp 0x180002ca2
mov rbx, rcx
test rbx, rbx
je 0x180002d39
mov rcx, rbx
test rbp, rbp
je 0x180002cd4
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x180002d2c
cmp rbx, rdi
je 0x180002ccd
mov rcx, rbx
call fcn.180002700
mov eax, 1
jmp 0x180002d3b
mov edx, esi
call fcn.180002ac0
test eax, eax
je 0x180002d2c
cmp rbx, rdi
je 0x180002cec
mov rcx, rbx
call fcn.180002700
mov rax, qword [0x180029bd8]
test rax, rax
je 0x180002d15
test esi, esi
je 0x180002d15
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call rax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x180002d3b
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x180002d3b
cmp rbx, rdi
je 0x180002d39
mov rcx, rbx
call fcn.180002700
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov r9d, dword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x180002c60
mov r8, rdx
xor edx, edx
jmp 0x180002e70
Function at 0x180002ee0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push r14
sub rsp, 0x58
mov r14, rcx
test rdx, rdx
je 0x180002f08
or r9d, 0x20006
mov r8d, r9d
call fcn.1800026b0
mov rbx, rax
jmp 0x180002f0b
mov rbx, rcx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], r15
test rbx, rbx
je 0x18000306b
mov rsi, qword [rsp + 0x90]
xor r12d, r12d
mov r15d, 2
mov edi, r12d
cmp dword [rsi + 8], r12d
jle 0x180002f7c
nop word [rax + rax]
lea rdx, [rsp + 0x78]
mov r8d, edi
mov rcx, rsi
call fcn.180002ec0
mov rcx, qword [rax]
mov eax, dword [rcx - 8]
lea rcx, [rsp + 0x78]
lea r15d, [r15 + rax*2 + 2]
call fcn.1800019e0
inc edi
cmp edi, dword [rsi + 8]
jl 0x180002f50
mov ecx, r15d
mov edi, r15d
call fcn.1800034fc
mov rbp, rax
test rax, rax
je 0x18000306b
mov r8d, edi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x38], r13
call fcn.1800033a0
mov r13, rbp
cmp dword [rsi + 8], r12d
jle 0x18000300d
nop
lea rdx, [rsp + 0x78]
mov r8d, r12d
mov rcx, rsi
call fcn.180002ec0
mov rdx, r13
mov rcx, qword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
add rdx, 2
add rcx, 2
mov word [rdx - 2], ax
test ax, ax
jne 0x180002fd0
lea rcx, [rsp + 0x78]
call fcn.1800019e0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
inc r12d
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
lea r13, [r13 + rcx*2]
cmp r12d, dword [rsi + 8]
jl 0x180002fb0
mov rdx, qword [rsp + 0x80]
mov r9d, 7
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r13, qword [rsp + 0x38]
test eax, eax
jne 0x180003056
cmp rbx, r14
je 0x180003047
mov rcx, rbx
call fcn.180002700
mov rcx, rbp
call fcn.180003320
mov eax, 1
jmp 0x18000306d
mov rcx, rbp
call fcn.180003320
cmp rbx, r14
je 0x18000306b
mov rcx, rbx
call fcn.180002700
xor eax, eax
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
add rsp, 0x58
pop r14
pop rbx
ret
Function at 0x180005987
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180028100]
jne 0x18000331a
rol rcx, 0x10
test cx, 0xffff
jne 0x180003316
repz ret
ror rcx, 0x10
jmp 0x1800058e0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180029cc0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180029db8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180005965
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180029cc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180005987
mov rax, qword [rsp + 0x88]
mov qword [0x180029db8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180029d58], rax
mov rax, qword [0x180029db8]
mov qword [0x180029c30], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180029d40], rax
mov dword [0x180029c20], 0xc0000409
mov dword [0x180029c24], 1
mov rax, qword [0x180028100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180028108]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180029cb8], eax
mov ecx, 1
call fcn.18000dcdc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18001e6b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180029cb8], 0
jne 0x180005a0e
mov ecx, 1
call fcn.18000dcdc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180008a3c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1800088b0
Function at 0x180010860
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18000693c
xor ebx, ebx
mov rdi, rax
cmp qword [0x18002a9b0], rbx
jne 0x180010966
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180010a3b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010a3b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18002a9b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18002a9b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18002a9c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18002a9d0], rax
test rax, rax
je 0x18001095d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18002a9c8], rax
jmp 0x18001096d
mov rax, qword [0x18002a9c8]
jmp 0x180010974
mov rax, qword [0x18002a9c8]
mov r11, qword [0x18002a9d0]
cmp rax, rdi
je 0x1800109dc
cmp r11, rdi
je 0x1800109dc
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18002a9d0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800109dc
test rax, rax
je 0x1800109dc
call rsi
test rax, rax
je 0x1800109d6
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800109d6
test byte [rsp + 0x38], 1
jne 0x1800109dc
bts ebp, 0x15
jmp 0x180010a1a
mov rcx, qword [0x18002a9b8]
cmp rcx, rdi
je 0x180010a1a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180010a1a
call rax
mov rbx, rax
test rax, rax
je 0x180010a1a
mov rcx, qword [0x18002a9c0]
cmp rcx, rdi
je 0x180010a1a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180010a1a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18002a9b0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180010a3b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180010a3d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180015730
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [0x18002ad3c], 0
jne 0x18001584f
lea rcx, [0x18002aac0]
mov edi, 1
mov dword [0x18002aac0], 0x114
mov dword [0x18002ad3c], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor r11d, r11d
cmp dword [0x18002aad0], 2
sete r11b
mov dword [0x18002992c], r11d
test r11d, r11d
je 0x18001582f
lea rcx, [0x18002abe0]
mov qword [rsp + 0x30], rbx
mov dword [0x18002abe0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, [0x180020490]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x180020478]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180020468]
mov rcx, rbx
mov qword [0x18002aab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x30]
mov qword [0x18002ad30], rax
mov rax, qword [0x18002aab8]
lea rcx, [0x18002ad00]
test rax, rax
je 0x1800157f9
call rax
jmp 0x1800157ff
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x18002abe4]
cmp eax, 6
jae 0x180015818
cmp eax, 5
jne 0x18001582f
cmp dword [0x18002abe8], 2
jb 0x18001582f
mov ecx, dword [0x18002aab0]
cmp word [0x18002ad00], 9
cmove ecx, edi
mov dword [0x18002aab0], ecx
lea rdx, [0x18002aac8]
lea rcx, [0x18002aac4]
call fcn.1800155f0
call fcn.180015380
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1800161b0
Capabilities:
Delete service

Disassembly:
push rdi
sub rsp, 0x50
mov rdi, rcx
call fcn.180015880
test eax, eax
je 0x1800161d4
mov dword [0x18002ad48], 0x32
xor eax, eax
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x1800161eb
mov dword [0x18002ad48], 0x57
xor eax, eax
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov r9d, 0xf01ff
mov r8d, 0xf003f
mov rdx, rdi
mov dword [0x18002ad48], ebx
call fcn.180015f80
lea rcx, [rsp + 0x20]
call fcn.180016020
test rax, rax
je 0x180016247
lea rcx, [rsp + 0x20]
call fcn.180016020
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
test eax, eax
jne 0x180016265
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18002ad48], eax
jmp 0x18001624d
mov eax, dword [0x18002ad48]
test eax, eax
jne 0x180016265
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x18001625f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18002ad48], eax
lea rcx, [rsp + 0x20]
call fcn.180016080
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180016280
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov ebp, edx
mov rdi, rcx
call fcn.180015880
test eax, eax
je 0x1800162bc
mov dword [0x18002ad48], 0x32
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x1800162dd
mov dword [0x18002ad48], 0x57
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 0x10]
lea r8d, [rbx + 2]
mov rdx, rdi
mov dword [0x18002ad48], ebx
call fcn.180015f80
lea rcx, [rsp + 0x20]
call fcn.180016020
test rax, rax
je 0x180016346
lea rcx, [rsp + 0x20]
call fcn.180016020
mov r8, rsi
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
test eax, eax
jne 0x180016364
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18002ad48], eax
cmp eax, 0x420
jne 0x18001634c
mov ebx, 1
jmp 0x180016364
mov eax, dword [0x18002ad48]
test eax, eax
jne 0x180016364
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x18001635e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18002ad48], eax
lea rcx, [rsp + 0x20]
call fcn.180016080
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180016520
Capabilities:
Modify service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8c8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x180028100]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
mov r15d, r9d
mov r14d, r8d
mov r13d, edx
mov rsi, rcx
mov rax, qword [rsp + 0x930]
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x938]
mov rax, qword [rsp + 0x940]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x948]
mov qword [rsp + 0x80], rax
mov r12, qword [rsp + 0x950]
mov rbx, qword [rsp + 0x958]
mov rax, qword [rsp + 0x960]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x968]
mov qword [rsp + 0x98], rax
xor eax, eax
mov ebp, eax
lea rcx, [rsp + 0x68]
call fcn.180002140
nop
test r12, r12
je 0x1800165e7
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.1800023a0
test rbx, rbx
je 0x1800165f9
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1800023a0
xor ebx, ebx
mov word [rsp + 0xb0], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0xb2]
call fcn.1800033a0
mov dword [rsp + 0x60], 0x400
cmp dword [rsp + 0x70], ebx
jle 0x18001665c
xor edx, edx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.180017fe0
test eax, eax
jne 0x180016654
lea rcx, [rsp + 0x68]
call fcn.180002200
xor eax, eax
jmp 0x1800166dc
lea rbp, [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8d, r14d
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
test eax, eax
je 0x1800166d0
test rdi, rdi
je 0x1800166d0
mov rdx, rdi
mov rcx, rsi
call fcn.1800160e0
nop
lea rcx, [rsp + 0x68]
call fcn.180002200
mov eax, ebx
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.180003300
add rsp, 0x8c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180016a20
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r9d
mov edi, r8d
mov rbx, rcx
cmp r8d, 0xffffffff
je 0x180016a60
cmp r8d, 4
jbe 0x180016a60
mov dword [0x18002ad4c], 0x57
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbp
mov rbp, qword [rcx]
cmp edx, 0xffffffff
je 0x180016a7c
mov r8d, edx
mov rdx, qword [0x180029958]
call fcn.180002e30
cmp edi, 0xffffffff
je 0x180016a93
mov rdx, qword [str.Start]
mov r8d, edi
mov rcx, rbx
call fcn.180002e30
cmp esi, 0xffffffff
je 0x180016aaa
mov rdx, qword [str.ErrorControl]
mov r8d, esi
mov rcx, rbx
call fcn.180002e30
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x180016ac3
mov rdx, qword [str.DisplayName]
mov rcx, rbx
call fcn.180002e60
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x180016adc
mov rdx, qword [str.Description]
mov rcx, rbx
call fcn.180002e60
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x180016b1a
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, 2
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, qword [str.ImagePath]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x40]
test r8, r8
je 0x180016b38
mov rdx, qword [str.Group]
mov rcx, rbx
call fcn.180002e60
mov r8, qword [rsp + 0x80]
test r8, r8
je 0x180016b54
mov rdx, qword [str.DependOnGroup]
mov rcx, rbx
call fcn.1800031e0
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x180016b70
mov rdx, qword [str.DependOnService]
mov rcx, rbx
call fcn.1800031e0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x180016b90
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
test rcx, rcx
jne 0x180016bb3
xor eax, eax
jmp 0x180016c61
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x180016c61
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.1800031f0
nop
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800030d0
test rax, rax
je 0x180016c18
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180002e80
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.180002d60
test edi, edi
jne 0x180016c55
mov r9d, 0x2001f
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800030d0
test rax, rax
je 0x180016c55
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180002e80
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.180002d60
nop
lea rcx, [rsp + 0x28]
call fcn.180003090
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180016dd0
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, r8
mov esi, edx
mov rdi, rcx
test rcx, rcx
je 0x180016f82
test rbx, rbx
je 0x180016f82
cmp word [rcx], 0
je 0x180016f82
cmp word [r8], 0
je 0x180016f82
lea rcx, [rsp + 0x28]
call fcn.1800031f0
nop
cmp esi, 2
je 0x180016e8f
cmp esi, 1
je 0x180016e8f
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800030d0
test rax, rax
jne 0x180016e78
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.180002d80
test rax, rax
jne 0x180016e78
jmp 0x180016f78
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180002e60
mov ebx, eax
jmp 0x180016f5f
mov rax, qword [0x18001e4b8]
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
lea rdx, [0x1800202d8]
lea rcx, [rsp + 0x50]
call fcn.180002090
mov r9d, 0x2001f
mov r8, qword [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800030d0
test rax, rax
jne 0x180016ee7
lea rcx, [rsp + 0x50]
call fcn.1800019e0
nop
jmp 0x180016f78
mov rax, qword [0x18001e4b8]
mov qword [rsp + 0x68], rax
mov edx, 0x5c
mov rcx, rbx
call fcn.180003ed4
test rax, rax
je 0x180016f13
lea rdx, [rax + 2]
lea rcx, [rsp + 0x68]
call fcn.180001af0
mov r8, qword [rsp + 0x68]
cmp dword [r8 - 8], 0
jne 0x180016f37
lea rcx, [rsp + 0x68]
call fcn.1800019e0
nop
lea rcx, [rsp + 0x50]
call fcn.1800019e0
nop
jmp 0x180016f78
mov rdx, qword [str.StaticVxD]
lea rcx, [rsp + 0x28]
call fcn.180002e60
mov ebx, eax
lea rcx, [rsp + 0x68]
call fcn.1800019e0
nop
lea rcx, [rsp + 0x50]
call fcn.1800019e0
lea rcx, [rsp + 0x28]
call fcn.180002d60
nop
lea rcx, [rsp + 0x28]
call fcn.180003090
mov eax, ebx
jmp 0x180016f84
lea rcx, [rsp + 0x28]
call fcn.180003090
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
jmp 0x180016dd0