joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400015b9
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140043ff0
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov r8, rdx
lea rdx, [rsp + 0x38]
call fcn.140001be0
nop
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
cmp r8, rax
je 0x140044134
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14004407f
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x78], ebx
cmp qword [rdi + 0x18], 0x10
jb 0x14004404d
mov rdi, qword [rdi]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r8, qword [rsp + 0x38]
test eax, eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x70]
je 0x140044081
mov ecx, ebx
sub ecx, 4
je 0x1400440fa
dec ecx
je 0x1400440cf
cmp ecx, 6
jne 0x140044134
cmp byte [0x14007ca62], 0
je 0x1400440ca
sub rax, r8
cmp rax, 8
je 0x1400440ca
mov r9d, 0x356
lea r8, str...CommonWinUtils.cpp
lea rdx, str.baseVal.size____8
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov r8, qword [rsp + 0x38]
mov rbx, qword [r8]
jmp 0x140044134
cmp r8, rax
je 0x1400440fa
dec rax
cmp r8, rax
je 0x1400440f0
movzx edx, byte [r8]
movzx ecx, byte [rax]
mov byte [r8], cl
mov byte [rax], dl
inc r8
cmp r8, rax
jne 0x1400440d4
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
cmp byte [0x14007ca62], 0
je 0x140044131
sub rax, r8
cmp rax, 4
je 0x140044131
mov r9d, 0x34d
lea r8, str...CommonWinUtils.cpp
lea rdx, str.baseVal.size____4
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov r8, qword [rsp + 0x38]
movsxd rbx, dword [r8]
test r8, r8
je 0x14004414e
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP110.dll_public:_void___cdecl_std::_Container_base0::_Orphan_all_void____ptr64]
mov rcx, qword [rsp + 0x38]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14000199c
Capabilities:
Check os version

Disassembly:
jmp 0x140033eb0
push rbx
sub rsp, 0x150
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
cmp dword [0x14007cbc4], ebx
jne 0x1400340a3
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov dword [0x14007cbc4], ebx
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400340a3
cmp dword [rsp + 0x30], 2
je 0x140033f31
cmp byte [0x14007ca62], bl
je 0x140034043
mov r9d, 0x16c
lea rdx, str.__Unknown_platform_ID_
jmp 0x140034030
mov eax, dword [rsp + 0x24]
cmp eax, 3
jb 0x14003404f
cmp eax, 4
jbe 0x14003401b
cmp eax, 5
je 0x140033fb8
cmp eax, 6
jne 0x14003404f
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140033fa9
dec eax
je 0x140034077
dec eax
je 0x140033f9a
dec eax
je 0x140033f8b
cmp byte [0x14007ca62], bl
je 0x140034077
mov r9d, 0x15d
lea rdx, str.__Unknown_minor_version__assume_Win7__
jmp 0x140034064
mov dword [0x14007cbc4], 6
jmp 0x140034081
mov dword [0x14007cbc4], 5
jmp 0x140034081
mov dword [0x14007cbc4], 3
jmp 0x140034081
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x14003400b
dec eax
je 0x140033ff0
dec eax
je 0x140033fff
cmp byte [0x14007ca62], bl
je 0x140033ff0
lea r8, str...Commonwinplats.cpp
lea rdx, str.__Unknown_minor_version__assume_XP__
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x143
call fcn.1400031a2
mov dword [0x14007cbc4], 1
jmp 0x140034081
mov dword [0x14007cbc4], 2
jmp 0x140034081
cmp byte [0x14007ca62], bl
je 0x140034043
mov r9d, 0x136
jmp 0x140034029
cmp byte [0x14007ca62], bl
je 0x140034043
mov r9d, 0x12e
lea rdx, str.__Obsolete_platform_ID_
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 7
jmp 0x140034081
cmp byte [0x14007ca62], bl
je 0x140034077
mov r9d, 0x164
lea rdx, str.__Unknown_NT_Platform__assume_Win7__
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 4
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call fcn.140002a27
movzx ecx, word [rsp + 0x134]
mov word [0x14007cbc8], cx
mov dword [0x14007cbcc], eax
cmp dword [0x14007cbc4], 3
sete al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x150
pop rbx
ret

Function at 0x1400019e7
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x14004cba0
push rbx
sub rsp, 0x60
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov dword [rsp + 0x40], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x140003c47]
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], al
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x38], 0x10
mov rbx, qword [rsp + 0x48]
jb 0x14004cbff
mov rcx, qword [rsp + 0x20]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x60
pop rbx
ret
Function at 0x140001be0
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140043e90
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rbx, r8
mov rdi, rdx
mov r14, rcx
xor r8d, r8d
mov dword [rax - 0x28], r8d
mov qword [rdx], r8
mov qword [rdx + 8], r8
mov qword [rdx + 0x10], r8
mov dword [rax - 0x28], 1
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x140043f8d
mov dword [rax + 8], r8d
cmp qword [rbx + 0x18], 0x10
jb 0x140043eee
mov rdx, qword [rbx]
jmp 0x140043ef1
mov rdx, rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140043f8d
mov esi, dword [rsp + 0x60]
test esi, esi
je 0x140043f8d
lea ecx, [rsi + 1]
call fcn.14005299c
mov rbp, rax
mov dword [rsp + 0x60], esi
cmp qword [rbx + 0x18], 0x10
jb 0x140043f31
mov rbx, qword [rbx]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140043f85
mov ebx, dword [rsp + 0x60]
add rbx, rbp
mov rcx, rdi
call qword [sym.imp.MSVCP110.dll_public:_void___cdecl_std::_Container_base0::_Orphan_all_void____ptr64]
mov rdx, qword [rdi]
mov qword [rdi + 8], rdx
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0x20], al
mov r9, rbx
mov r8, rbp
mov rcx, rdi
call fcn.140002770
mov rcx, rbp
call sub.MSVCR110.dll_void___cdecl_operator_delete___void____ptr64_
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140001bea
Capabilities:
Check os version

Disassembly:
jmp 0x140034150
push rbx
sub rsp, 0x150
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
cmp dword [0x14007cbc4], ebx
jne 0x140034343
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov dword [0x14007cbc4], ebx
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140034343
cmp dword [rsp + 0x30], 2
je 0x1400341d1
cmp byte [0x14007ca62], bl
je 0x1400342e3
mov r9d, 0x16c
lea rdx, str.__Unknown_platform_ID_
jmp 0x1400342d0
mov eax, dword [rsp + 0x24]
cmp eax, 3
jb 0x1400342ef
cmp eax, 4
jbe 0x1400342bb
cmp eax, 5
je 0x140034258
cmp eax, 6
jne 0x1400342ef
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140034249
dec eax
je 0x140034317
dec eax
je 0x14003423a
dec eax
je 0x14003422b
cmp byte [0x14007ca62], bl
je 0x140034317
mov r9d, 0x15d
lea rdx, str.__Unknown_minor_version__assume_Win7__
jmp 0x140034304
mov dword [0x14007cbc4], 6
jmp 0x140034321
mov dword [0x14007cbc4], 5
jmp 0x140034321
mov dword [0x14007cbc4], 3
jmp 0x140034321
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x1400342ab
dec eax
je 0x140034290
dec eax
je 0x14003429f
cmp byte [0x14007ca62], bl
je 0x140034290
lea r8, str...Commonwinplats.cpp
lea rdx, str.__Unknown_minor_version__assume_XP__
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x143
call fcn.1400031a2
mov dword [0x14007cbc4], 1
jmp 0x140034321
mov dword [0x14007cbc4], 2
jmp 0x140034321
cmp byte [0x14007ca62], bl
je 0x1400342e3
mov r9d, 0x136
jmp 0x1400342c9
cmp byte [0x14007ca62], bl
je 0x1400342e3
mov r9d, 0x12e
lea rdx, str.__Obsolete_platform_ID_
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 7
jmp 0x140034321
cmp byte [0x14007ca62], bl
je 0x140034317
mov r9d, 0x164
lea rdx, str.__Unknown_NT_Platform__assume_Win7__
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 4
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call fcn.140002a27
movzx ecx, word [rsp + 0x134]
mov word [0x14007cbc8], cx
mov dword [0x14007cbcc], eax
cmp dword [0x14007cbc4], 4
sete al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x150
pop rbx
ret
Function at 0x14000215d
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x14004c520
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x58], rdx
xor r15d, r15d
mov dword [rsp + 0x44], r15d
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov qword [rdx + 0x10], r15
mov dword [rsp + 0x44], 1
cmp qword [rcx + 0x28], r15
je 0x14004c68f
mov byte [rbp - 0x80], r15b
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp - 0x7f]
call sub.MSVCR110.dll_memset
mov dword [rsp + 0x40], 0x400
mov esi, r15d
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14004c68f
nop word [rax + rax]
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], 0
cmp byte [rbp - 0x80], 0
jne 0x14004c60e
mov r8, r15
jmp 0x14004c620
lea rax, [rbp - 0x80]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14004c616
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400017d0
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140001483
nop
cmp qword [rsp + 0x78], 0x10
jb 0x14004c64f
mov rcx, qword [rsp + 0x60]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov dword [rsp + 0x40], 0x400
inc esi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
mov edx, esi
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14004c5f0
mov rax, rbx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140052d40
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140002162
Capabilities:
Query environment variable

Disassembly:
jmp 0x140023be0
push rbx
push rsi
push rdi
sub rsp, 0x830
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, rcx
mov esi, r8d
mov rdi, rdx
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x20], ax
call sub.MSVCR110.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x140023cab
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140023c40
lea r9, [rsp + 0x20]
lea rcx, [rsp + 0x20]
lea r10, [0x14006311a]
lea r9, [r9 + rax*2]
lea rax, [0x140063118]
cmp rcx, r9
je 0x140023c91
lea r8, [rsp + 0x20]
sub r8, rax
cmp rax, r10
je 0x140023cab
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x140023c96
add rax, 2
lea rdx, [r8 + rax]
cmp rdx, r9
jne 0x140023c75
cmp rax, r10
je 0x140023cab
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.MSVCR110.dll_wcsncpy]
mov al, 1
jmp 0x140023cad
xor al, al
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x830
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400023d3
Capabilities:
Check os version

Disassembly:
jmp 0x1400356e0
sub rsp, 0x158
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [0x14007cbc4], 0
je 0x14003570a
test cl, cl
je 0x1400358de
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov dword [0x14007cbc4], 0
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400358de
cmp dword [rsp + 0x30], 2
je 0x140035767
cmp byte [0x14007ca62], 0
je 0x14003587d
mov r9d, 0x16c
lea rdx, str.__Unknown_platform_ID_
jmp 0x14003586a
mov eax, dword [rsp + 0x24]
cmp eax, 3
jb 0x140035889
cmp eax, 4
jbe 0x140035854
cmp eax, 5
je 0x1400357ef
cmp eax, 6
jne 0x140035889
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x1400357e0
dec eax
je 0x1400358b2
dec eax
je 0x1400357d1
dec eax
je 0x1400357c2
cmp byte [0x14007ca62], 0
je 0x1400358b2
mov r9d, 0x15d
lea rdx, str.__Unknown_minor_version__assume_Win7__
jmp 0x14003589f
mov dword [0x14007cbc4], 6
jmp 0x1400358bc
mov dword [0x14007cbc4], 5
jmp 0x1400358bc
mov dword [0x14007cbc4], 3
jmp 0x1400358bc
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140035843
dec eax
je 0x140035828
dec eax
je 0x140035837
cmp byte [0x14007ca62], 0
je 0x140035828
lea r8, str...Commonwinplats.cpp
lea rdx, str.__Unknown_minor_version__assume_XP__
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x143
call fcn.1400031a2
mov dword [0x14007cbc4], 1
jmp 0x1400358bc
mov dword [0x14007cbc4], 2
jmp 0x1400358bc
cmp byte [0x14007ca62], 0
je 0x14003587d
mov r9d, 0x136
jmp 0x140035863
cmp byte [0x14007ca62], 0
je 0x14003587d
mov r9d, 0x12e
lea rdx, str.__Obsolete_platform_ID_
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 7
jmp 0x1400358bc
cmp byte [0x14007ca62], 0
je 0x1400358b2
mov r9d, 0x164
lea rdx, str.__Unknown_NT_Platform__assume_Win7__
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 4
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call fcn.140002a27
mov dword [0x14007cbcc], eax
movzx eax, word [rsp + 0x134]
mov word [0x14007cbc8], ax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x158
ret
Function at 0x14000258b
Capabilities:
Check os version

Disassembly:
jmp 0x140033380
push rbx
sub rsp, 0x150
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
cmp dword [0x14007cbc4], ebx
jne 0x140033575
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov dword [0x14007cbc4], ebx
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140033575
cmp dword [rsp + 0x30], 2
je 0x140033401
cmp byte [0x14007ca62], bl
je 0x140033513
mov r9d, 0x16c
lea rdx, str.__Unknown_platform_ID_
jmp 0x140033500
mov eax, dword [rsp + 0x24]
cmp eax, 3
jb 0x14003351f
cmp eax, 4
jbe 0x1400334eb
cmp eax, 5
je 0x140033488
cmp eax, 6
jne 0x14003351f
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140033479
dec eax
je 0x140033547
dec eax
je 0x14003346a
dec eax
je 0x14003345b
cmp byte [0x14007ca62], bl
je 0x140033547
mov r9d, 0x15d
lea rdx, str.__Unknown_minor_version__assume_Win7__
jmp 0x140033534
mov dword [0x14007cbc4], 6
jmp 0x140033551
mov dword [0x14007cbc4], 5
jmp 0x140033551
mov dword [0x14007cbc4], 3
jmp 0x140033551
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x1400334db
dec eax
je 0x1400334c0
dec eax
je 0x1400334cf
cmp byte [0x14007ca62], bl
je 0x1400334c0
lea r8, str...Commonwinplats.cpp
lea rdx, str.__Unknown_minor_version__assume_XP__
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x143
call fcn.1400031a2
mov dword [0x14007cbc4], 1
jmp 0x140033551
mov dword [0x14007cbc4], 2
jmp 0x140033551
cmp byte [0x14007ca62], bl
je 0x140033513
mov r9d, 0x136
jmp 0x1400334f9
cmp byte [0x14007ca62], bl
je 0x140033513
mov r9d, 0x12e
lea rdx, str.__Obsolete_platform_ID_
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 7
jmp 0x140033551
cmp byte [0x14007ca62], bl
je 0x140033547
mov r9d, 0x164
lea rdx, str.__Unknown_NT_Platform__assume_Win7__
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 4
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call fcn.140002a27
movzx ecx, word [rsp + 0x134]
mov word [0x14007cbc8], cx
mov dword [0x14007cbcc], eax
jmp 0x14003357b
mov eax, dword [0x14007cbcc]
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x150
pop rbx
ret
Function at 0x14000277f
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
jmp 0x14002b1d0
push rdi
sub rsp, 0x70
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
xor edi, edi
call fcn.1400022ca
cmp byte [0x14007ca62], dil
je 0x14002b267
call fcn.14000283d
cmp eax, 0x14
je 0x14002b267
call fcn.14000283d
cmp eax, 0x15
je 0x14002b267
call fcn.14000283d
cmp eax, 0x1e
je 0x14002b267
call fcn.14000283d
cmp eax, 0x28
je 0x14002b267
call fcn.14000283d
cmp eax, 0x32
je 0x14002b267
call fcn.14000283d
cmp eax, 0x33
je 0x14002b267
call fcn.14000283d
cmp eax, 0x3c
je 0x14002b267
call fcn.14000283d
cmp eax, 0x3d
je 0x14002b267
lea r8, str.ServiceMain.cpp
lea rdx, str.EOSTYPE_IS_WIN_CSystemState::GetOSType___
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x24d
call fcn.1400031a2
call fcn.14000283d
cmp eax, 0x14
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x15
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x1e
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x28
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x32
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x33
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x3c
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x3d
jne 0x14002b3e1
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x88], rsi
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14002b3d9
lea rcx, [rsp + 0x40]
mov edx, 4
mov r8d, 0x201
mov qword [rsp + 0x80], rbx
call fcn.140003337
cmp qword [rax + 0x18], 0x10
jb 0x14002b304
mov rax, qword [rax]
mov r8d, 0x10024
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp qword [rsp + 0x58], 0x10
mov rbx, rax
jb 0x14002b32b
mov rcx, qword [rsp + 0x40]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x40], dil
test rbx, rbx
je 0x14002b3c8
xor eax, eax
lea r8, [rsp + 0x20]
mov rcx, rbx
lea edx, [rax + 1]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14002b3b4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14002b3b4
nop
cmp dword [rsp + 0x24], 1
je 0x14002b3b4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14002b390
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x70
pop rdi
ret
Function at 0x140002919
Capabilities:
Get common file path

Disassembly:
jmp 0x140043800
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x840
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x30], bx
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x30]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14004388a
cmp byte [0x14007ca60], bl
je 0x14004386f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetSystemDirectory_failed__i_n
mov edx, eax
call fcn.1400031a2
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
xor r8d, r8d
mov word [rdi], bx
lea rdx, [0x1400624f4]
jmp 0x1400438c2
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rsp + 0x30], bx
je 0x1400438ba
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400438b0
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140002ef5
mov rax, rdi
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140052d40
mov rbx, qword [rsp + 0x858]
add rsp, 0x840
pop rdi
ret

Function at 0x140002b3f
Capabilities:
Get common file path

Disassembly:
jmp 0x1400229a0
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x840
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x30], bx
call sub.MSVCR110.dll_memset
lea r8d, [rbx + 0x1a]
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rsp + 0x30], bx
je 0x140022a1c
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140022a12
lea rdx, [rsp + 0x30]
mov r8, rbx
mov rcx, rdi
call fcn.140002ef5
mov rax, rdi
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140052d40
mov rbx, qword [rsp + 0x858]
add rsp, 0x840
pop rdi
ret
Function at 0x140002b99
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140042520
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov ebx, ecx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400425eb
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
call sub.MSVCR110.dll_memset
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400425cb
cmp dword [rsp + 0x28], ebx
je 0x1400425a5
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140042583
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140042600
cmp byte [0x14007ca60], 0
mov ebx, dword [rsp + 0x40]
je 0x1400425e0
lea rcx, str.GetParentInstanceOfProcessID:_Matched___returning_parentID:__i_n
mov edx, ebx
call fcn.1400031a2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140042600
cmp byte [0x14007ca60], 0
je 0x1400425e0
lea rcx, str.GetParentInstanceOfProcessID:Process32FirstW_failed_n
call fcn.1400031a2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140042600
cmp byte [0x14007ca60], 0
je 0x140042600
lea rcx, str.GetParentInstanceOfProcessID:CreateToolhelp32Snapshot_failed_n
call fcn.1400031a2
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140052d40
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret