joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a8a84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rdi, r8
mov rbx, rdx
mov rdx, rcx
lea r8, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, r8
je 0x1400a8af2
test byte [rcx + 0x1c], 4
je 0x1400a8af2
mov rax, qword [rdi + 8]
add rax, qword [rdi]
mov r9, qword [rbx + 8]
add r9, qword [rbx]
mov edx, 0xf
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.1400a87c4
mov rcx, qword [0x140158280]
mov rdx, qword [rsp + 0xc0]
lea r8, [0x140158280]
mov r12, qword [rbx + 8]
mov r13, qword [rbx]
lea rbp, [r12 + r13]
mov qword [rsp + 0xd8], rbp
mov rax, qword [rdi + 8]
mov qword [rsp + 0xc8], rax
mov r15, qword [rdi]
lea r14, [r15 + rax]
mov qword [rsp + 0x30], r14
cmp r14, rbp
je 0x1400a8b48
xor esi, esi
cmp r14, rbp
jge 0x1400a8b5b
cmp rcx, r8
je 0x1400a8b48
test byte [rcx + 0x1c], 1
je 0x1400a8b48
lea edx, [rsi + 0x10]
mov qword [rsp + 0x20], r14
mov r9, rbp
mov rcx, qword [rcx + 0x10]
call fcn.1400a87c4
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
add rdx, 0x10
mov r8, rbx
lea rcx, [rsp + 0x50]
call fcn.1400a9dd4
nop
mov ecx, 0x400
call fcn.1400e9770
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rdi, [rax + 0x400]
mov qword [rsp + 0x48], rdi
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.1400eb6e0
mov qword [rsp + 0x40], rdi
sub r15, r13
sub r15, r12
add r15, qword [rsp + 0xc8]
mov qword [rsp + 0xc8], 0
je 0x1400a8c80
mov r13, rdi
sub r13, rbx
mov rbp, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xc0]
mov rax, r15
sub rax, rbp
cmp rax, r13
cmovae rax, r13
mov qword [rsp + 0xd0], rax
mov r8, rax
mov rdx, rbx
mov rcx, r14
call fcn.1400a91c0
xor r12d, r12d
mov r8, r13
mov rdx, qword [rsp + 0xd0]
cmp rdx, r13
cmovbe r8, rdx
mov rax, r8
shr rax, 2
and r8d, 3
xor ecx, ecx
test rax, rax
je 0x1400a8c2e
xor r12d, dword [rcx + rbx]
add rcx, 4
sub rax, 1
jne 0x1400a8c20
test r8, r8
je 0x1400a8c64
xor eax, eax
mov dword [rsp + 0xc8], eax
test r8, r8
je 0x1400a8c61
lea rdx, [rcx + rbx]
lea rcx, [rsp + 0xc8]
call fcn.1400ebaa0
mov eax, dword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
xor r12d, eax
xor esi, r12d
add rbp, rdx
cmp rbp, r15
jb 0x1400a8bd6
mov rbp, qword [rsp + 0xd8]
mov r14, qword [rsp + 0x30]
test rbx, rbx
je 0x1400a8cb5
sub rdi, rbx
cmp rdi, 0x1000
jb 0x1400a8ca9
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1400a8d02
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.1400e9768
nop
mov rdx, qword [rsp + 0x58]
add rdx, qword [rsp + 0x60]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call fcn.1400a90e0
nop
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400a8cfb
test byte [rcx + 0x1c], 4
je 0x1400a8cfb
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9, rbp
mov rcx, qword [rcx + 0x10]
call fcn.140086f14
mov eax, esi
jmp 0x1400a8b4a
call fcn.1400be7a4
int3
Function at 0x1400acb68
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14015da88]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov rax, qword [rcx + 0x148]
xor r9d, r9d
shr rcx, 4
mov r8d, r9d
mov qword [rsp], rcx
mov ecx, r9d
mov rdx, qword [rax + 8]
movups xmm0, xmmword [rdx - 0x10]
movdqu xmmword [rsp + 8], xmm0
movzx eax, byte [rsp + rcx + 8]
inc rcx
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
cmp rcx, 0x10
jb 0x1400acba1
movzx eax, byte [rsp + r9]
inc r9
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
cmp r9, 8
jb 0x1400acbc2
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, 0x6fd91d85
imul r8d, ecx, 0x8001
mul r8d
shr edx, 0x12
imul ecx, edx, 0x927c0
sub r8d, ecx
lea eax, [r8 + 0x927c0]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400e9450
add rsp, 0x28
ret
Function at 0x1400aea48
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
and qword [rax + 0x10], 0
mov r8, rcx
lea rdx, str._ls.bak
lea rcx, [rax + 0x10]
call fcn.1400b4ccc
mov ebx, eax
test eax, eax
jns 0x1400aea8f
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400aea88
call fcn.1400e9470
mov eax, ebx
jmp 0x1400aeb68
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400afeb0
mov edi, eax
cmp eax, 0x80070001
jle 0x1400aeb15
lea ecx, [rax + 0x7ff8fffc]
cmp ecx, 0x7ff8fffb
jbe 0x1400aeb15
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400aeb04
call fcn.1400b4f5c
mov edi, eax
test eax, eax
jns 0x1400aeb04
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x1400aeb59
test byte [rcx + 0x1c], 1
je 0x1400aeb59
mov edx, 0x1d
mov r9d, edi
lea r8, [0x140138728]
mov rcx, qword [rcx + 0x10]
call fcn.1400059f4
jmp 0x1400aeb59
test rbx, rbx
je 0x1400aeb11
mov rcx, rbx
call fcn.1400e9470
xor eax, eax
jmp 0x1400aeb68
lea rax, [0x140158280]
mov rcx, qword [0x140158280]
cmp rcx, rax
je 0x1400aeb4b
test byte [rcx + 0x1c], 1
je 0x1400aeb4b
mov edx, 0x1c
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [0x140138728]
mov rcx, qword [rcx + 0x10]
call fcn.1400263e0
mov edx, edi
lea rcx, str.ERROR:_UtilDeletePathSafe___failed___X__n
call fcn.1400ae8a0
test rbx, rbx
je 0x1400aeb66
mov rcx, rbx
call fcn.1400e9470
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400af36c
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400b401c
test al, al
je 0x1400af3ed
lea esi, [rdi + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, ebx
cmp esi, ecx
ja 0x1400af3b5
sub ebx, eax
cmp esi, ebx
jbe 0x1400af3d7
mov edx, edi
lea rcx, str.ERROR:_Process_Hand___timeout__lu_n
call fcn.1400ae8a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400b401c
test al, al
jne 0x1400af3a1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b415c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x1400b4185
mov eax, 0x80070057
jmp 0x1400b420b
mov r8d, edx
jmp 0x1400b41a5
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x1400b4209
test eax, eax
je 0x1400b4202
cmp eax, ebx
ja 0x1400b4202
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400b418a
call fcn.1400b4f5c
mov ebx, eax
test eax, eax
jns 0x1400b4209
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b41fe
test byte [rcx + 0x1c], 1
je 0x1400b41fe
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139750]
mov edx, 0x13
mov r9d, ebx
call fcn.1400059f4
mov eax, ebx
jmp 0x1400b420b
mov ebx, 0x8000ffff
jmp 0x1400b41cd
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b427c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400b42dc
call fcn.1400b4f5c
mov ebx, eax
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b42d8
test byte [rcx + 0x1c], 1
je 0x1400b42d8
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139750]
mov edx, 0x15
mov r9d, ebx
call fcn.1400059f4
mov eax, ebx
jmp 0x1400b42e6
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400b42ec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rdx]
mov r10, r8
mov rbx, rdx
cmp rdi, qword [rdx]
je 0x1400b430d
mov eax, 0x80070057
jmp 0x1400b4390
and qword [rdx], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, r10
and qword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400b437a
call fcn.1400b4f5c
mov edi, eax
cmp eax, 0x80070026
jne 0x1400b4345
and qword [rbx], 0
jmp 0x1400b438e
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b4376
test byte [rcx + 0x1c], 1
je 0x1400b4376
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139750]
mov edx, 0x16
mov r9d, edi
call fcn.1400059f4
mov eax, edi
jmp 0x1400b4390
cmp dword [rsp + 0x48], edi
jbe 0x1400b4387
mov eax, 0x8000ffff
jmp 0x1400b4390
mov eax, dword [rsp + 0x48]
mov qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b4730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400b4799
call fcn.1400b4f5c
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400b4795
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b4795
test byte [rcx + 0x1c], 1
je 0x1400b4795
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139750]
mov edx, 0x1e
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140005648
mov eax, ebx
jmp 0x1400b479d
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b4878
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400b4895
xor eax, eax
jmp 0x1400b48f4
call fcn.1400b4f5c
mov ebx, eax
cmp eax, 0x800700b7
je 0x1400b48e0
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b48dc
mov edx, 1
test byte [rcx + 0x1c], dl
je 0x1400b48dc
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139750]
mov edx, 0x21
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140005648
mov eax, ebx
jmp 0x1400b48f4
mov rcx, rdi
call fcn.1400b47a8
test eax, eax
mov edx, 1
cmovs edx, eax
mov eax, edx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b4900
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400b491b
xor eax, eax
jmp 0x1400b4964
call fcn.1400b4f5c
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400b4962
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b4962
test byte [rcx + 0x1c], 1
je 0x1400b4962
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139750]
mov edx, 0x24
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140005648
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b4970
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400b4900
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x1400b49a9
cmp eax, 0x80070005
jne 0x1400b49ae
mov rcx, rbx
call fcn.1400b49b4
test eax, eax
js 0x1400b49ae
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400b4900
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400b49b4
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, 0x80
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400b4a18
call fcn.1400b4f5c
mov ebx, eax
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b4a14
test byte [rcx + 0x1c], 1
je 0x1400b4a14
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139750]
mov edx, 0x26
mov dword [rsp + 0x28], ebx
mov r9, rdi
mov dword [rsp + 0x20], 0x80
call fcn.1400b3ee0
mov eax, ebx
jmp 0x1400b4a1a
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b4a28
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x1400b4a9c
call fcn.1400b4f5c
mov ebx, eax
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b4a98
test byte [rcx + 0x1c], 1
je 0x1400b4a98
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139750]
mov edx, 0x27
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.140005648
mov eax, ebx
jmp 0x1400b4abe
cmp r9d, ebx
ja 0x1400b4ab2
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x1400b4ab9
mov eax, 0x8000ffff
jmp 0x1400b4abe
test ebx, ebx
je 0x1400b4ab9
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b510c
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
lea rax, [rax + 0x18]
mov rsi, rdx
mov dword [rsp + 0x50], edi
and dword [rax], edi
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 0x24]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400b51b2
call fcn.1400b4f5c
mov ebx, eax
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b5199
test byte [rcx + 0x1c], 1
je 0x1400b5199
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1400b5064
mov rcx, qword [0x140158280]
lea edx, [rdi + 0xc]
lea r8, [0x140139760]
mov dword [rsp + 0x20], ebx
mov r9, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov edi, 1
test dil, 1
je 0x1400b51ae
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400b51ae
call fcn.1400e9470
mov eax, ebx
jmp 0x1400b51b4
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b51c4
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
xor ebx, ebx
mov rdx, rcx
mov dword [rsp + 0x50], ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400b5257
call fcn.1400b4f5c
mov edi, eax
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b523f
test byte [rcx + 0x1c], 1
je 0x1400b523f
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1400b5064
mov rcx, qword [0x140158280]
lea edx, [rbx + 0xd]
lea r8, [0x140139760]
mov dword [rsp + 0x20], edi
mov r9, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov ebx, 1
test bl, 1
je 0x1400b5253
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b5253
call fcn.1400e9470
mov eax, edi
jmp 0x1400b5259
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b54f8
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400b5594
call fcn.1400b4f5c
mov ebx, eax
cmp eax, 0x80070420
jne 0x1400b552d
lea eax, [rdi + 1]
jmp 0x1400b5596
mov rax, qword [0x140158280]
lea rcx, [0x140158280]
cmp rax, rcx
je 0x1400b557b
test byte [rax + 0x1c], 1
je 0x1400b557b
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1400b5064
mov rcx, qword [0x140158280]
lea r8, [0x140139760]
mov edx, 0x10
mov dword [rsp + 0x20], ebx
mov r9, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov edi, 1
test dil, 1
je 0x1400b5590
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400b5590
call fcn.1400e9470
mov eax, ebx
jmp 0x1400b5596
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b55a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14015da88]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
xorps xmm0, xmm0
mov edi, edx
mov rsi, rcx
movups xmmword [rsp + 0x20], xmm0
mov rdx, rcx
mov qword [r11 - 0x28], rax
lea rcx, [r11 - 0x38]
mov dword [rsp + 0x38], eax
call fcn.1400b51c4
test eax, eax
js 0x1400b56bf
cmp dword [rsp + 0x24], 1
jne 0x1400b5600
xor eax, eax
jmp 0x1400b56bf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, edi
ja 0x1400b56ba
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1400b51c4
test eax, eax
js 0x1400b56bf
cmp dword [rsp + 0x24], 1
je 0x1400b55f9
cmp dword [rsp + 0x24], 3
je 0x1400b5608
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1400b5695
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x1400b5695
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b5691
test byte [rcx + 0x1c], 1
je 0x1400b5691
mov edx, 0x11
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139760]
mov r9d, ebx
call fcn.1400059f4
mov eax, ebx
jmp 0x1400b56bf
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
mov ebx, 0x80004005
cmp rcx, rax
je 0x1400b5691
test byte [rcx + 0x1c], 1
je 0x1400b5691
mov edx, 0x12
jmp 0x1400b567e
mov eax, 0x800705b4
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e9450
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400b5828
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [rsp + 0x98]
xor ebx, ebx
mov rsi, rcx
mov dword [rsp + 0x88], ebx
or ecx, 0xffffffff
cmp edx, ecx
jne 0x1400b585b
test rax, rax
je 0x1400b5906
and qword [rsp + 0x50], rbx
mov r8d, edx
and qword [rsp + 0x48], rbx
mov r9d, ecx
and qword [rsp + 0x40], rbx
mov edx, ecx
and qword [rsp + 0x38], rbx
mov rcx, rsi
and qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1400b5906
call fcn.1400b4f5c
mov edi, eax
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b58eb
test byte [rcx + 0x1c], 1
je 0x1400b58eb
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.1400b5064
mov rcx, qword [0x140158280]
lea r8, [0x140139760]
mov edx, 0x16
mov dword [rsp + 0x20], edi
mov r9, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140005648
mov ebx, 1
test bl, 1
je 0x1400b5902
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400b5902
call fcn.1400e9470
mov eax, edi
jmp 0x1400b5908
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400b5c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [r9]
mov rdi, r9
mov eax, r14d
mov r15, r8
mov dword [rsp + 0x68], eax
mov rbp, rdx
cmp rax, r14
je 0x1400b5c47
mov ebx, 0x80070057
jmp 0x1400b5c8f
mov rbx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x1400b5cc9
test rbx, rbx
je 0x1400b5caa
mov eax, dword [rsp + 0x68]
cmp rax, qword [rdi]
jbe 0x1400b5caa
mov ebx, 0x800700ea
mov qword [rdi], rax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, dword [rsp + 0x68]
mov r9, rdi
mov qword [rdi], rax
mov rdx, r14
mov r8d, dword [r15]
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call fcn.1400b5b74
jmp 0x1400b5c91
mov ebx, 0x80070002
cmp esi, ebx
jne 0x1400b5d05
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b5c8f
test byte [rcx + 0x1c], 4
je 0x1400b5c8f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139770]
mov edx, 0x16
mov r9, rbp
call fcn.140005570
jmp 0x1400b5c8f
mov ebx, 0x800700ea
cmp esi, ebx
je 0x1400b5d4a
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b5d43
test byte [rcx + 0x1c], 1
je 0x1400b5d43
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139770]
mov edx, 0x17
mov dword [rsp + 0x20], esi
mov r9, rbp
call fcn.140005648
mov ebx, esi
jmp 0x1400b5c8f
mov eax, dword [rsp + 0x68]
cmp qword [rdi], rax
jb 0x1400b5c8c
mov ebx, 0x8000ffff
jmp 0x1400b5c8f
Function at 0x1400b605c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdi, rdx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x1400b60d3
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b60c2
test byte [rcx + 0x1c], 1
je 0x1400b60c2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139770]
mov edx, 0x19
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.14000583c
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
test eax, eax
js 0x1400b60d5
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b61a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rcx + 0x20], 0
mov r12, rdx
mov rdi, rcx
jne 0x1400b61d3
mov eax, 0x80070057
jmp 0x1400b638f
mov rsi, qword [rdi + 0x28]
mov r15, qword [rdi + 0x20]
mov r13, rsi
mov r14, qword [rdi + 0x18]
mov eax, esi
mov dword [rbp + 0x40], esi
cmp rax, rsi
je 0x1400b61f6
mov ebx, 0x80070057
jmp 0x1400b6301
mov eax, r14d
cmp rax, r14
jne 0x1400b61ec
mov rcx, qword [rdi + 0x10]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x38], r8
mov edx, r14d
and qword [rsp + 0x30], 0
mov r8, r15
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400b6291
mov ecx, dword [rbp + 0x40]
mov edx, 0x800700ea
inc ecx
mov dword [rbp + 0x40], ecx
test r15, r15
je 0x1400b6255
mov eax, ecx
cmp rax, rsi
cmova ebx, edx
mov esi, ecx
mov eax, ebx
mov qword [rbp - 0x10], rsi
cmp ebx, edx
je 0x1400b62f7
cmp ebx, 0x80070103
je 0x1400b62f7
test ebx, ebx
js 0x1400b6301
mov r9, r15
lea r8, [rbp - 0x10]
mov rdx, r13
mov rcx, r14
call fcn.1400b60e0
mov rsi, qword [rbp - 0x10]
jmp 0x1400b62f7
cmp ebx, 0x80070103
jne 0x1400b629d
mov eax, ebx
jmp 0x1400b62f7
mov edx, 0x800700ea
cmp ebx, edx
je 0x1400b62dd
mov rcx, qword [0x140158280]
lea rax, [0x140158280]
cmp rcx, rax
je 0x1400b6301
test byte [rcx + 0x1c], 1
je 0x1400b6301
mov rcx, qword [rcx + 0x10]
lea r8, [0x140139770]
mov edx, 0x1b
mov dword [rsp + 0x20], ebx
mov r9d, r14d
call fcn.1400057f8
jmp 0x1400b6301
mov ecx, dword [rbp + 0x40]
inc ecx
mov eax, ecx
mov dword [rbp + 0x40], ecx
cmp rsi, rax
jb 0x1400b62f3
mov ebx, 0x8000ffff
jmp 0x1400b6301
mov esi, ecx
mov eax, edx
mov ebx, eax
test eax, eax
jns 0x1400b6381
cmp ebx, 0x80070103
je 0x1400b637a
xor eax, eax
mov ecx, 0x800700ea
cmp ebx, ecx
cmovne eax, ebx
cmp eax, 0x8007139f
jne 0x1400b6329
inc qword [rdi + 0x18]
mov r8, qword [rbp + 0x50]
jmp 0x1400b61d3
test eax, eax
js 0x1400b638f
and qword [rbp + 0x40], 0
lea rcx, [rbp + 0x40]
mov rdx, rsi
call fcn.14008a804
mov ebx, eax
test eax, eax
js 0x1400b6368
mov rcx, qword [rdi + 0x20]
mov rax, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rsi
test rcx, rcx
je 0x1400b61d3
call fcn.1400e9470
jmp 0x1400b6320
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400b6376
call fcn.1400e9470
mov eax, ebx
jmp 0x1400b638f
and qword [r12], 0
jmp 0x1400b638d
mov rax, qword [rdi + 0x20]
inc qword [rdi + 0x18]
mov qword [r12], rax
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret