joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068cb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, rdx
mov r13, rcx
xor r12b, r12b
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rdx, [0x1400de328]
test rdx, 0xffffffffffff0000
jne 0x140068d3a
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x140068d47
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.140001f70
jmp 0x140068d47
xor r8d, r8d
lea rcx, [rbp - 0x31]
call fcn.140001e80
nop
xor r14d, r14d
mov qword [rbp - 0x21], r14
mov dword [rbp - 0x19], r14d
mov qword [rbp - 0x11], r14
mov word [rbp - 1], r14w
xor eax, eax
mov qword [rbp + 1], rax
mov qword [rbp + 9], rax
mov word [rbp + 0x11], ax
mov r9d, 0x2001f
lea r8, str.Control_PanelDesktop
mov rdx, qword [rsi + 0x30]
lea rcx, [rbp - 0x21]
call fcn.140008440
mov rbx, qword [rbp - 0x21]
test eax, eax
jne 0x140068e62
mov dword [rbp - 0x39], reloc.ATL100.DLL_Ordinal_20
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.ScreenSaveActive
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140068e49
mov eax, dword [rbp - 0x29]
cmp eax, 1
je 0x140068dd4
cmp eax, 2
jne 0x140068e49
mov eax, dword [rbp - 0x39]
test eax, eax
je 0x140068dec
test al, 1
jne 0x140068e49
shr rax, 1
cmp word [rbp + rax*2 - 3], 0
je 0x140068df1
jmp 0x140068e49
mov word [rbp - 1], r14w
lea rsi, [rbp - 1]
lea r15, [0x1400e2b48]
mov rdi, r15
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
jne 0x140068e0e
mov r12b, 1
jmp 0x140068e49
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov edi, 1
mov r9d, edi
xor r8d, r8d
lea rdx, str.ScreenSaveActive
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx r12d, r12b
test eax, eax
cmove r12d, edi
test rbx, rbx
je 0x140068e5e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x19], r14d
call fcn.1400193c0
cmp eax, 0x51
je 0x140068e89
add eax, 0xffffffa0
cmp eax, 2
ja 0x140068e84
xor edx, edx
mov rcx, qword [r13 + 0xd8]
call fcn.140033420
jmp 0x140068e95
xor r12b, r12b
jmp 0x140068e95
mov ecx, 0x80000003
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
nop
test rbx, rbx
je 0x140068ea4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140068ec3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, r12b
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006cc50
Capabilities:
Get session user name
Impersonate user

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rsi, rcx
xor eax, eax
lea rdi, [r11 - 0x58]
movzx ebp, dl
mov ecx, reloc.ATL100.DLL_Ordinal_56
lea rdx, [r11 + 0x18]
rep stosb byte [rdi], al
xor ecx, ecx
xor bl, bl
mov qword [r11 + 0x20], rax
mov dword [r11 + 0x18], eax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [rsp + 0x90]
test eax, eax
jne 0x14006cc9a
test ecx, ecx
je 0x14006cd4b
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ca8e8
lea rdx, [rsp + 0x90]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14006cd3e
test rdi, rdi
je 0x14006cd4b
mov dword [rsp + 0x20], reloc.ATL100.DLL_Ordinal_56
mov qword [rsp + 0x28], rdi
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea rdx, [rsp + 0x98]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14006cd3e
lea rdx, [rsp + 0x20]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x14006cd3e
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14006cd3e
lea rdx, [rsp + 0x20]
mov rcx, rsi
test bpl, bpl
je 0x14006cd36
call fcn.140065760
jmp 0x14006cd3b
call fcn.140068cb0
movzx ebx, al
test rdi, rdi
je 0x14006cd4b
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14006cd6e
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14006cd81
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14006cd81
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400731e0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov qword [rbp - 0x61], 0xfffffffffffffffe
mov rbx, rdx
mov r13, rcx
xor r12b, r12b
mov dword [rcx + 0x10], 3
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x7f], rax
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 0x67]
mov rcx, r13
call fcn.1400669d0
xor r14d, r14d
or esi, 0xffffffff
test al, al
je 0x1400733d9
lea rcx, [rbp - 0x59]
call fcn.14004a620
nop
lea r8, [rbp + 0x7f]
mov edx, dword [rbp + 0x67]
lea rcx, [rbp - 0x59]
call fcn.1400480e0
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], r14
mov rdx, rbx
lea rcx, [rbp - 0x69]
call fcn.140002710
nop
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x59]
call fcn.14004bf40
nop
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400732ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
mov rbx, qword [rsp + 0x20]
sub rcx, rbx
movabs rax, 0x2e8ba2e8ba2e8ba3
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140073390
mov rcx, qword [rbx + 0x48]
sub rcx, 0x18
call fcn.140001b90
lea rbx, [rax + 0x18]
mov qword [rbp - 0x79], rbx
mov dword [rbp + 0x77], r14d
lea r8, [rbp + 0x77]
mov rdx, rbx
mov rcx, r13
call fcn.1400672e0
test al, al
je 0x14007336c
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x71], rax
lea r8, [rbp - 0x71]
mov rdx, rbx
mov rcx, r13
call fcn.140068ef0
mov rbx, qword [rbp - 0x71]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
movzx r12d, r12b
mov ecx, 1
test eax, eax
cmovne r12d, ecx
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140073368
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x79]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140073386
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
test rbx, rbx
je 0x1400733c1
cmp rbx, rdi
je 0x1400733b9
nop word [rax + rax]
mov rcx, rbx
call fcn.14002be60
add rbx, 0x160
cmp rbx, rdi
jne 0x1400733a0
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], r14
lea rcx, [rbp - 0x59]
call fcn.14004bd80
mov dword [r13 + 0x10], r14d
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400733fa
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, r12b
add rsp, 0xe0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140073410
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xb0]
xor ebx, ebx
mov rbp, rcx
sub rax, qword [rcx + 0xa8]
sar rax, 6
movsxd rdi, eax
cmp edx, 2
jne 0x14007348b
test eax, eax
jle 0x1400734cf
mov esi, ebx
nop dword [rax]
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rsi + rax + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor r9d, r9d
mov edx, ebx
mov rcx, rbp
test eax, eax
je 0x140073473
xor r8d, r8d
jmp 0x140073479
mov r8d, 2
call fcn.140072590
inc ebx
add rsi, 0x40
dec rdi
jne 0x140073450
jmp 0x1400734cf
test eax, eax
jle 0x1400734cf
mov rsi, rbx
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rsi + rax + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, ebx
mov rcx, rbp
test eax, eax
je 0x1400734b5
xor r9d, r9d
xor r8d, r8d
jmp 0x1400734bf
mov r9d, dword [rbp + 0x20]
mov r8d, 1
call fcn.140072590
inc ebx
add rsi, 0x40
dec rdi
jne 0x140073492
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14008ad00
Capabilities:
Check if file exists
Delete file

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rsi
mov rbp, rdx
mov rsi, rcx
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14008a110
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14008ad71
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne dil
test dil, dil
je 0x14008ad93
lea rcx, [rsi + 8]
mov rdx, rbp
call fcn.140089dc0
mov rcx, rsi
call fcn.14008a740
mov rcx, rsi
call fcn.1400899c0
test al, al
setne dil
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14008adaf
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140092da0
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
xor dil, dil
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x140092e91
lea rdx, [rsi + 0x68]
mov r8d, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140092e88
mov rax, qword [str.Agent_for_VAIO_Update.]
lea rdi, [rsp + 0x20]
mov ecx, 8
mov qword [rsp + 0x28], rax
mov rax, qword [0x1400eac08]
lea r8, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [0x1400eac10]
mov edx, 1
mov qword [rsp + 0x38], rax
mov rax, qword [0x1400eac18]
mov qword [rsp + 0x40], rax
mov rax, qword [0x1400eac20]
mov qword [rsp + 0x48], rax
mov eax, dword [0x1400eac28]
mov dword [rsp + 0x50], eax
movzx eax, word [0x1400eac2c]
mov word [rsp + 0x54], ax
xor eax, eax
rep stosb byte [rdi], al
lea rax, [rsp + 0x28]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dil, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x1400931b0
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x278
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9, rdx
mov edx, 0x100
mov rbx, rcx
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll__vsnwprintf_s]
xor edi, edi
lea rax, [rsp + 0x60]
mov word [rsp + 0x25e], di
mov qword [rsp + 0x50], rax
cmp dword [rbx + 0x28c], edi
jne 0x140093224
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR100.dll__putws]
lea rdx, [rbx + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140093275
mov qword [rsp + 0x40], rdi
mov ecx, 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], cx
lea edx, [rcx + 3]
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400cafa0
add rsp, 0x278
pop rdi
pop rbx
ret
Function at 0x140093550
Capabilities:
Create service

Disassembly:
push rbx
sub rsp, 0xa90
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rbx, rcx
call fcn.140093290
test eax, eax
je 0x140093581
mov eax, 1
jmp 0x14009368a
lea rdx, [rsp + 0x72]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400937a6
cmp eax, 0x104
je 0x1400937a6
lea ecx, [rax + 1]
mov r8d, 0x22
mov qword [rsp + 0xaa8], rsi
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
add eax, 2
xor esi, esi
xor ecx, ecx
mov r8d, 0xf003f
xor edx, edx
mov qword [rsp + 0xab0], rdi
mov word [rsp + rax*2 + 0x70], si
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x1400936a3
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80a
call fcn.140092b10
test eax, eax
jne 0x140093661
lea r8, str.Could_not_open_Service_Manager
lea rcx, [rsp + 0x280]
mov edx, 0x400
call qword [sym.imp.MSVCR100.dll_wcscpy_s]
test eax, eax
je 0x140093661
cmp eax, 0xc
je 0x140093656
cmp eax, 0x16
je 0x14009364b
cmp eax, 0x22
je 0x14009364b
cmp eax, 0x50
je 0x140093661
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x8007000e
call fcn.140001000
int3
lea r8, [rbx + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rsi, qword [rsp + 0xaa8]
mov rdi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.1400cafa0
add rsp, 0xa90
pop rbx
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
add rbx, 0x68
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], Ordinal_20
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x14009378a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80b
call fcn.140092b10
test eax, eax
jne 0x14009377f
lea r8, str.Could_not_start_service
lea rcx, [rsp + 0x280]
mov edx, 0x400
call qword [sym.imp.MSVCR100.dll_wcscpy_s]
test eax, eax
je 0x14009377f
cmp eax, 0xc
je 0x140093774
cmp eax, 0x16
je 0x140093769
cmp eax, 0x22
je 0x140093769
cmp eax, 0x50
je 0x14009377f
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x8007000e
call fcn.140001000
int3
xor r9d, r9d
mov r8, rbx
jmp 0x140093668
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14009367a
xor eax, eax
jmp 0x14009368a
Function at 0x140093db0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x50], rax
test rax, rax
jne 0x140093dd8
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
lea r8, [0x140093b60]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140093e15
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140093f80
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbp
push rsi
sub rsp, 0x78
movzx ebp, dl
mov rsi, rcx
call fcn.1400937b0
test eax, eax
jne 0x140093fa2
mov eax, 0x80004005
add rsp, 0x78
pop rsi
pop rbp
ret
mov rcx, qword [0x14011dd70]
mov qword [rsp + 0x90], rbx
xor ebx, ebx
lea rax, str.APPID
mov qword [rsp + 0x70], rdi
lea rdi, str.9E6E16CC_84B2_4E7F_A839_26BD17D6E906
lea edx, [rbx + 0x65]
lea r8d, [rbx + 1]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
call fcn.14004cca0
test eax, eax
js 0x140094152
lea r8, str.AppID
lea rcx, [rsp + 0x50]
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
call fcn.140008440
test eax, eax
je 0x140094043
mov ecx, eax
call fcn.140092ba0
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test rcx, rcx
je 0x14009403c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140094152
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xa8], rbx
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa8]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
mov rbx, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140094139
mov rdi, qword [rsp + 0xa8]
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test bpl, bpl
je 0x140094119
lea rbp, [rsi + 0x68]
test rbp, rbp
je 0x1400940ea
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.LocalService
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call fcn.140093550
test eax, eax
jne 0x140094119
test rdi, rdi
je 0x140094104
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140094112
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
jmp 0x140094152
test rdi, rdi
je 0x140094127
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140094135
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140094152
mov ecx, eax
call fcn.140092ba0
mov edi, eax
test rbx, rbx
je 0x140094150
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x70]
add rsp, 0x78
pop rsi
pop rbp
ret
Function at 0x140094170
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x58
call fcn.1400937b0
test eax, eax
jne 0x140094187
mov eax, 0x80004005
add rsp, 0x58
ret
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea r8, str.AppID
lea rcx, [rsp + 0x20]
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], rbx
call fcn.140008440
test eax, eax
je 0x1400941e3
mov ecx, eax
call fcn.140092ba0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
test rcx, rcx
je 0x1400941d7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x20]
lea r8, str.9E6E16CC_84B2_4E7F_A839_26BD17D6E906
lea rcx, [rsp + 0x38]
mov r9d, 0x20006
mov rdx, rbx
mov qword [rsp + 0x50], rdi
call fcn.140008440
test eax, eax
je 0x140094251
mov ecx, eax
call fcn.140092ba0
mov rcx, qword [rsp + 0x38]
mov edi, eax
test rcx, rcx
je 0x140094232
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140094240
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rdi, qword [rsp + 0x38]
lea rdx, str.LocalService
mov qword [rsp + 0x68], rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
call fcn.140093ea0
mov esi, eax
test rdi, rdi
je 0x140094282
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140094290
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x68]
add rsp, 0x58
ret

Function at 0x140094830
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rsi, rdx
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
xor eax, eax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], eax
xor dil, dil
test rsi, rsi
je 0x140094907
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140094907
lea r9, [rsp + 0x58]
mov r8d, 8
lea rdx, [rsp + 0x68]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x140094907
mov ebp, 1
mov ecx, ebp
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400948d8
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140001c20
mov rbx, qword [rsp + 0x60]
mov r9d, 0x104
mov r8, rbx
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleBaseNameW
lea rdx, str.VAIOUpdt.exe
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsicmp]
movzx edi, dil
test eax, eax
cmove edi, ebp
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140094923
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, dil
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret