joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001a5c0
Capabilities:
Delete registry value
Set registry value

Disassembly:
jmp 0x10001a5c0
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov bpl, dl
mov rsi, rcx
call fcn.1000015cd
test eax, eax
je 0x10001a5e5
mov eax, 0x80004005
jmp 0x10001a792
mov rcx, qword [0x10002e3b0]
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov edx, 0x65
lea rax, [0x10000ba60]
lea rdi, [0x10000b6e0]
lea r8d, [rdx - 0x64]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdi
call fcn.10000161d
test eax, eax
js 0x10001a792
and qword [rsp + 0x98], 0
lea rax, [rsp + 0x98]
lea rdx, [0x10000ad20]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001a78b
and qword [rsp + 0x38], 0
mov rbx, qword [rsp + 0x98]
and qword [rsp + 0x30], 0
and qword [rsp + 0x90], 0
lea rcx, [rsp + 0x90]
mov rdx, rbx
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], eax
call fcn.100001758
test eax, eax
je 0x10001a6da
mov ecx, eax
call fcn.1000017cb
mov rcx, qword [rsp + 0x90]
test rcx, rcx
mov edi, eax
je 0x10001a6c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10001a6d3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10001a792
mov rdi, qword [rsp + 0x90]
lea rdx, [0x10000ba98]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test bpl, bpl
jne 0x10001a717
test rdi, rdi
je 0x10001a705
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10001a713
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001a792
lea rbp, [rsi + 0x68]
test rbp, rbp
jne 0x10001a72b
mov ecx, 0x80004005
call fcn.10000110e
int3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x10000ba98]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call fcn.100001145
test eax, eax
jne 0x10001a6f7
test rdi, rdi
je 0x10001a774
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10001a5db
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10001a5db
mov ecx, eax
call fcn.1000017cb
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x10001a820
Capabilities:
Delete registry value

Disassembly:
jmp 0x10001a820
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
call fcn.10000119f
test eax, eax
jne 0x10001a842
mov eax, 0x80004005
jmp 0x10001a939
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov edi, 0x20006
lea rdx, [0x10000ad20]
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001a932
mov rbx, qword [rsp + 0x68]
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
lea rsi, [0x10000b6e0]
mov rcx, rbx
mov r9d, edi
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001a917
mov rdi, qword [rsp + 0x70]
lea rdx, [0x10000ba98]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [0x10002e3b0]
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
xor r8d, r8d
lea r11, [0x10000ba60]
lea r9, [rsp + 0x30]
lea edx, [r8 + 0x65]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r11
call fcn.10000161d
test rdi, rdi
mov esi, eax
je 0x10001a905
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10001a913
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10001a939
mov ecx, eax
call fcn.1000017cb
test rbx, rbx
mov edi, eax
je 0x10001a92e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10001a939
mov ecx, eax
call fcn.1000017cb
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x10001b154
Capabilities:
Accept command line arguments
Modify service
Query service status
Start service

Disassembly:
jmp 0x10001b154
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
cmp byte [0x10002e389], 0
mov ebx, r9d
mov rsi, r8
je 0x10001b17a
or edi, 0xffffffff
jmp 0x10001b1b3
and dword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x60]
lea rcx, [0x10002e450]
mov rdx, rax
call fcn.1000016fe
cmp al, 1
jne 0x10001b1af
lea rcx, [0x10002e450]
mov edx, ebx
call fcn.1000016ea
mov edi, eax
jmp 0x10001b1b3
mov edi, dword [rsp + 0x60]
lea rcx, [0x10000bb98]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10001b2db
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rsi, rax
je 0x10001b2b7
lea rdx, [0x10000bb70]
mov r8d, 0x16
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x10001b2ae
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or edx, 0xffffffff
mov r8d, 2
mov r9d, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea r11, [0x10000bb6c]
lea r8, [rsp + 0x68]
mov edx, 1
mov rcx, rbx
mov qword [rsp + 0x68], r11
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
and dword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov r9d, 0x24
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b2a5
cmp dword [rsp + 0x74], 1
jne 0x10001b2a5
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r9d, 1
lea rdx, [0x10000bb58]
lea rcx, [0x10000b6e0]
mov r8d, r9d
mov dword [rsp + 0x20], 0xb
call fcn.1000018a7
lea r11, [rsp + 0xa0]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x10001b6f4
Capabilities:
Compare security identifiers

Disassembly:
jmp 0x10001b6f4
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x40
and dword [rsp + 0x30], 0
mov r14, rcx
xor ecx, ecx
and qword [r11 - 0x30], rcx
and qword [r11 - 0x38], rcx
mov rax, rdx
lea ebx, [rcx + 2]
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x38], ecx
lea rdx, [r11 - 0x38]
mov rcx, rax
mov r15d, r9d
mov esi, ebx
mov r13d, r8d
call fcn.100001492
test eax, eax
mov edi, eax
jne 0x10001b845
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x30]
mov r9d, ebx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x10001b83d
mov ebp, dword [rsp + 0x30]
add ebp, 0xffffffff
js 0x10001b845
lea r8, [rsp + 0x28]
mov edx, ebp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x10001b83d
mov rbx, qword [rsp + 0x28]
or eax, 0xffffffff
cmp dword [rsp + 0x80], 0
je 0x10001b7ac
cmp dword [rsp + 0x80], eax
jne 0x10001b7b1
cmp byte [rbx], 0
je 0x10001b7e1
cmp dword [rsp + 0x80], 1
je 0x10001b7c4
cmp dword [rsp + 0x80], eax
jne 0x10001b7c9
cmp byte [rbx], 1
je 0x10001b7e1
cmp dword [rsp + 0x80], 2
je 0x10001b7dc
cmp dword [rsp + 0x80], eax
jne 0x10001b832
cmp byte [rbx], 2
jne 0x10001b832
mov rcx, qword [rsp + 0x20]
lea rdx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10001b832
test r15d, r15d
je 0x10001b82c
movzx eax, word [rbx + 4]
test eax, eax
je 0x10001b82c
mov eax, r13d
not eax
and eax, dword [rbx + 4]
test al, 0x1e
mov dword [rbx + 4], eax
je 0x10001b818
or eax, 1
mov dword [rbx + 4], eax
jmp 0x10001b830
movzx eax, ax
test eax, eax
jne 0x10001b830
mov edx, ebp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeleteAce]
jmp 0x10001b830
or dword [rbx + 4], r13d
xor esi, esi
sub ebp, 1
jns 0x10001b779
jmp 0x10001b845
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x10001b855
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
test edi, edi
cmove edi, esi
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
Function at 0x10001b8e4
Capabilities:
Compare security identifiers

Disassembly:
jmp 0x10001b8e4
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
and dword [rsp + 0x28], 0
mov r13, rcx
xor ecx, ecx
and qword [r11 - 0x38], rcx
and qword [r11 + 0x20], rcx
mov rax, rdx
lea ebx, [rcx + 2]
mov dword [rsp + 0x2c], ecx
mov dword [rsp + 0x30], ecx
lea rdx, [r11 + 0x20]
mov rcx, rax
mov ebp, r8d
mov r12d, ebx
call fcn.100001492
test eax, eax
mov edi, eax
jne 0x10001b9d7
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x28]
mov r9d, ebx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x10001b9cf
mov esi, dword [rsp + 0x28]
add esi, 0xffffffff
js 0x10001b9d7
lea r8, [rsp + 0x20]
mov edx, esi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x10001b9cf
test ebp, ebp
mov rbx, qword [rsp + 0x20]
je 0x10001b97c
cmp ebp, 0xffffffff
jne 0x10001b981
cmp byte [rbx], 0
je 0x10001b99f
cmp ebp, 1
je 0x10001b98b
cmp ebp, 0xffffffff
jne 0x10001b990
cmp byte [rbx], 1
je 0x10001b99f
cmp ebp, 2
je 0x10001b99a
cmp ebp, 0xffffffff
jne 0x10001b9c8
cmp byte [rbx], 2
jne 0x10001b9c8
mov rcx, qword [rsp + 0x78]
lea rdx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10001b9c8
movzx eax, word [rbx + 4]
test eax, eax
je 0x10001b9c5
mov edx, esi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeleteAce]
xor r12d, r12d
sub esi, 1
jns 0x10001b95a
jmp 0x10001b9d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x10001b9e7
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
test edi, edi
cmove edi, r12d
mov eax, edi
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x10001ba58
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x10001ba58
sub rsp, 0x258
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x240], rax
and qword [rsp + 0x38], 0
and dword [rsp + 0x34], 0
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x38]
lea rdx, [0x10000be50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001bb62
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10000be10]
xor r8d, r8d
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x10001bb0f
lea rcx, [0x10000bd60]
call qword [sym.imp.msvcrt.dll_wprintf]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10000bd18]
xor r8d, r8d
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x10001bb57
lea rcx, [0x10000bc50]
call qword [sym.imp.msvcrt.dll_wprintf]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x258
ret

Function at 0x10001c8f4
Capabilities:
Set registry value

Disassembly:
jmp 0x10001c8f4
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
and dword [rsp + 0x50], 0
and qword [r11 - 0x10], 0
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x10]
mov rdi, r9
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
mov rsi, r8
lea r9, [0x10000bb6c]
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov ebx, eax
jne 0x10001c975
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov rcx, qword [rsp + 0x58]
lea r9d, [rbx + 3]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x10001c985
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x10001c9c8
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x10001c9c8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
and dword [rax - 0x18], 0
and dword [rax + 0x20], 0
test r9, r9
mov rsi, r9
mov rbp, r8
jne 0x10001c9fe
mov eax, LoadRegTypeLib
jmp 0x10001cade
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x10001ca0b
and dword [rdi], 0
and qword [r9], 0
lea rax, [rsp + 0x38]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, eax
je 0x10001ca38
cmp eax, 2
je 0x10001ca9d
jmp 0x10001cade
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, eax
je 0x10001ca69
cmp eax, 0x7a
jne 0x10001ca9d
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.msvcrt.dll_malloc]
lea rcx, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
mov qword [rsi], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x10001cacc
mov rcx, qword [rsi]
test rcx, rcx
je 0x10001caaf
call qword [sym.imp.msvcrt.dll_free]
and qword [rsi], 0
test rdi, rdi
je 0x10001cacc
mov rcx, rsi
call fcn.100001348
test eax, eax
mov ebx, eax
jne 0x10001cacc
mov dword [rdi], 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x10001cadc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x10001d678
Capabilities:
Get user security identifier

Disassembly:
jmp 0x10001d678
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x250], rax
and word [rsp + 0x50], 0
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x1fe
call sub.msvcrt.dll_memset
and dword [rsp + 0x40], 0
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x44], 0xff
call fcn.100001181
test eax, eax
je 0x10001d6dd
xor eax, eax
jmp 0x10001d771
mov r8, qword [rsi]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov ebx, eax
jne 0x10001d76f
mov ecx, dword [rsp + 0x40]
xor ebx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
lea rcx, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x44]
mov rdx, rdi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov r8, rax
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov qword [rsi], rax
mov dword [rsp + 0x44], 0xff
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x10001d76f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1000218f0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x10001d884
Capabilities:
Check os version

Disassembly:
jmp 0x10001d884
push rbx
sub rsp, 0x150
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
xor ebx, ebx
mov dword [rsp + 0x20], 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
je 0x10001d8ff
cmp dword [rsp + 0x24], 5
lea eax, [rbx + 1]
jne 0x10001d8fc
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
jb 0x10001d8f8
jne 0x10001d8e9
cmp word [rsp + 0x134], 2
jmp 0x10001d8f6
cmp ecx, 2
jne 0x10001d8ff
cmp word [rsp + 0x134], ax
jae 0x10001d8ff
mov ebx, eax
jmp 0x10001d8ff
cmovb ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x150
pop rbx
ret

Function at 0x10001dfdc
Capabilities:
Check os version

Disassembly:
jmp 0x10001dfdc
push rbx
sub rsp, 0x150
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, VarUI4FromDisp
xor ebx, ebx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x10001e02f
cmp dword [rsp + 0x28], ebx
lea eax, [rbx + 1]
cmove ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x150
pop rbx
ret
Function at 0x10001e150
Capabilities:
Query service status

Disassembly:
jmp 0x10001e150
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov esi, 0x80000000
xor edx, edx
xor ecx, ecx
mov r8d, esi
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp rax, rbx
mov rdi, rax
je 0x10001e1d9
lea rdx, [0x10000b900]
mov r8d, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp rax, rbx
mov rsi, rax
je 0x10001e1d0
lea rax, [rsp + 0x78]
lea r9d, [rbx + 0x24]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, ebx
je 0x10001e1c7
cmp dword [rsp + 0x34], 4
lea eax, [rbx + 1]
cmove ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10001eef4
Capabilities:
Create thread

Disassembly:
jmp 0x10001eef4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
call fcn.100001005
cmp eax, ebx
je 0x10001ef3e
mov rcx, rdi
call fcn.100001186
lea r11, [rdi + 0x30]
lea r8, [0x10000114a]
mov qword [rsp + 0x28], r11
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, 1
mov qword [rdi + 0x28], rax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x10001ef68
Capabilities:
Create thread

Disassembly:
jmp 0x10001ef68
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x10001ef92
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x28], 0
cmp qword [rbx + 0x28], 0
jne 0x10001efbf
lea rax, [rbx + 0x30]
lea r8, [0x10000114a]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x28], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x10001fb50
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10001fbe3
cmp dword [rsp + 0x24], 5
jb 0x10001fbfd
jmp 0x10001fbf9
cmp dword [rsp + 0x30], esi
jne 0x10001fbfd
cmp dword [rsp + 0x24], 4
ja 0x10001fbf9
jne 0x10001fbfd
cmp dword [rsp + 0x28], 0
jbe 0x10001fbfd
mov byte [rbx + 0x18], sil
lea rax, [0x10000c8f0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1000013c5
movzx ecx, byte [0x10002e389]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x10002e389], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1000218f0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100021448
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r12
push r13
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x10002ef00], rdi
je 0x1000214a3
cmp rax, rdi
jne 0x100021496
mov r12d, 1
jmp 0x1000214a3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002147c
mov eax, dword [0x10002eef0]
cmp eax, 1
jne 0x1000214b8
lea ecx, [rax + 0x1e]
call fcn.1000c3000
jmp 0x10002151d
mov eax, dword [0x10002eef0]
test eax, eax
jne 0x100021513
mov dword [0x10002eef0], 1
lea r13, [0x100009b88]
lea rdi, [0x100006b58]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x24], eax
cmp rdi, r13
jae 0x100021505
test eax, eax
jne 0x100021505
mov rcx, qword [rdi]
test rcx, rcx
je 0x1000214fa
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000214e3
test eax, eax
je 0x10002151d
mov eax, 0xff
jmp 0x10002166a
mov dword [0x10002e96c], 1
mov eax, dword [0x10002eef0]
cmp eax, 1
jne 0x100021545
lea rdx, [0x100005b48]
lea rcx, [0x100002190]
call sub.msvcrt.dll__initterm
mov dword [0x10002eef0], 2
test r12d, r12d
jne 0x100021553
xor eax, eax
xchg qword [0x10002ef00], rax
cmp qword [0x10002ef28], 0
je 0x10002157c
lea rcx, [0x10002ef28]
call fcn.100021d30
test eax, eax
je 0x10002157c
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10002ef28]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], 0
jne 0x100021593
mov eax, 0xff
jmp 0x10002166a
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10002161c
cmp word [rcx], 0
je 0x1000215af
test edx, edx
jne 0x10002161c
cmp word [rcx], 0
je 0x1000215c6
cmp word [rcx], 0x20
ja 0x1000215c6
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000215af
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.10000172b
mov dword [0x10002e968], eax
cmp dword [0x10002e94c], 0
jne 0x100021605
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10002e96c], 0
jne 0x10002161a
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10002e968]
jmp 0x10002166a
cmp word [rcx], 0x22
jne 0x10002162f
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10002159f
lea r11, [rsp + 0xb0]
mov rdi, qword [r11 + 0x10]
mov r12, qword [r11 + 0x18]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.100021e98
add rsp, 0x28
jmp 0x100021448

Function at 0x100021df4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100021e3e
cmp rcx, 0xffffffffffffffff
je 0x100021e3e
cmp word [rcx], 0x5a4d
jne 0x100021e36
cmp dword [rcx + 0x3c], edx
jl 0x100021e36
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100021e36
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100021e3e
mov rax, rdx
add rsp, 0x18
ret