joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081e7c
Capabilities:
Shutdown system

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x30
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call fcn.14001bb58
mov ebx, eax
test eax, eax
jns 0x140081ed9
mov rcx, qword [0x1400df278]
lea rax, [0x1400df278]
cmp rcx, rax
je 0x140081fcf
test byte [rcx + 0x1c], 1
je 0x140081fcf
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c1ef8]
mov edx, 0x24
mov r9d, ebx
call fcn.14000a9b0
jmp 0x140081fcf
and qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop dword [rax + rax]
xor r8d, r8d
lea r9, [rsp + 0x48]
mov rcx, rax
lea edx, [r8 + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x140081f3d
call fcn.1400a8fb0
mov ebx, eax
test eax, eax
jns 0x140081f3d
mov rcx, qword [0x1400df278]
lea rax, [0x1400df278]
cmp rcx, rax
je 0x140081fb9
test byte [rcx + 0x1c], 1
je 0x140081fb9
mov edx, 0x25
jmp 0x140081fa6
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.1400a7210
mov ebx, eax
test eax, eax
jns 0x140081f72
mov rcx, qword [0x1400df278]
lea rax, [0x1400df278]
cmp rcx, rax
je 0x140081fb9
test byte [rcx + 0x1c], 1
je 0x140081fb9
mov edx, 0x26
jmp 0x140081fa6
mov cl, byte [rsp + 0x40]
mov al, cl
neg al
sbb ebx, ebx
not ebx
and ebx, 0x80070005
test cl, cl
jne 0x140081ff7
mov rcx, qword [0x1400df278]
lea rax, [0x1400df278]
cmp rcx, rax
je 0x140081fb9
test byte [rcx + 0x1c], 1
je 0x140081fb9
mov edx, 0x27
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c1ef8]
mov r9d, ebx
call fcn.14000a9b0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140081fcf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140081ff0
mov rdx, qword [rcx]
movsxd r8, dword [rdx + 4]
add rcx, r8
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [case.0x1400ad4ce.0]
mov eax, ebx
jmp 0x1400820d8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14008200d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14008202e
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ad4ce.0]
lea rcx, str.SeShutdownPrivilege
call fcn.1400a746c
mov ebx, eax
test eax, eax
jns 0x140082076
mov rcx, qword [0x1400df278]
lea rax, [0x1400df278]
cmp rcx, rax
je 0x140081ff0
test byte [rcx + 0x1c], 1
je 0x140081ff0
mov edx, 0x28
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c1ef8]
mov r9d, ebx
call fcn.14000a9b0
jmp 0x140081ff0
mov dword [rsp + 0x28], 0x50013
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_shutdown_l1_1_0.dll_InitiateSystemShutdownExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400820d6
call fcn.1400a8fb0
mov ebx, eax
test eax, eax
jns 0x1400820d6
mov rcx, qword [0x1400df278]
lea rax, [0x1400df278]
cmp rcx, rax
je 0x140081ff0
test byte [rcx + 0x1c], 1
je 0x140081ff0
mov edx, 0x29
jmp 0x14008205e
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140087218
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbx
sub rsp, 0x850
mov rax, qword [0x1400e6870]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov r11d, r8d
mov qword [rsp + 0x30], rcx
mov r10, rdx
mov dword [rsp + 0x30], 0x400
mov rbx, rcx
lea rax, [rsp + 0x30]
mov edx, r11d
mov qword [rsp + 0x20], rax
mov rcx, r10
lea r9, [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
nop dword [rax + rax]
mov rcx, rbx
lea rdx, [0x1400b7028]
cmp eax, 1
jne 0x140087284
lea rdx, [rsp + 0x40]
call fcn.1400462e0
mov rax, rbx
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400abb00
add rsp, 0x850
pop rbx
ret

Function at 0x14008db34
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x1400e6870]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x50], 0
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPasswordLessNgcStatus_
mov rdi, rcx
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.140003680
mov ebx, eax
test eax, eax
jns 0x14008db87
mov edx, 0x76
jmp 0x14008db9f
mov r8, rdi
lea rcx, [rsp + 0x60]
call fcn.14000370c
mov ebx, eax
test eax, eax
jns 0x14008dbbb
mov edx, 0x78
mov rcx, qword [rsp + 0x288]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov r9d, eax
call fcn.140004f24
jmp 0x14008dc92
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14008dbf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x60]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14008dc3c
mov edx, 0x7a
jmp 0x14008dc75
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov r9d, 4
lea rdx, str.NgcSetup
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14008dc90
mov edx, 0x7c
mov rcx, qword [rsp + 0x288]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov r9d, eax
call fcn.14008d814
mov ebx, eax
jmp 0x14008dc92
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14008dca8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400abb00
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret
Function at 0x14008dcd4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov rax, qword [0x1400e6870]
xor rax, rsp
mov qword [rbp + 0x160], rax
and dword [rdx], 0
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPasswordLessNgcStatus_
and dword [rsp + 0x30], 0
mov rsi, rdx
and dword [rsp + 0x44], 0
mov rdi, rcx
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov dword [rsp + 0x40], 4
call fcn.140003680
mov ebx, eax
test eax, eax
jns 0x14008dd47
mov edx, 0x8b
jmp 0x14008dd5f
mov r8, rdi
lea rcx, [rsp + 0x50]
call fcn.14000370c
mov ebx, eax
test eax, eax
jns 0x14008dd7a
mov edx, 0x8d
mov rcx, qword [rbp + 0x178]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov r9d, eax
call fcn.140004f24
jmp 0x14008de75
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14008ddaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx edi, ax
mov ebx, 0x80070000
or edi, ebx
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14008ddfd
mov ebx, 0x80070002
cmp edi, ebx
je 0x14008de75
mov edx, 0x91
jmp 0x14008de4d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.NgcSetup
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14008de67
mov ebx, 0x80070002
cmp edi, ebx
je 0x14008de75
mov edx, 0x95
mov rcx, qword [rbp + 0x178]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov r9d, edi
call fcn.140004f24
mov ebx, edi
jmp 0x14008de75
xor eax, eax
cmp dword [rsp + 0x30], 1
sete al
xor ebx, ebx
mov dword [rsi], eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008de8b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400abb00
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14008e448
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
and qword [r11 - 0x28], 0
lea rax, [r11 + 0x10]
and qword [r11 + 0x10], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPasswordLessDevice
mov qword [r11 - 0x30], rax
xor r9d, r9d
and qword [r11 - 0x38], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov rcx, 0xffffffff80000002
and dword [rsp + 0x20], 0
mov dword [rsp + 0x50], 2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14008e4a7
mov edx, 0x156
jmp 0x14008e4e0
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x50]
mov r9d, 4
lea rdx, str.DevicePasswordLessBuildVersion
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14008e4f8
mov edx, 0x15e
mov rcx, qword [rsp + 0x68]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov r9d, eax
call fcn.14008d814
mov ebx, eax
jmp 0x14008e4fa
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14008e510
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x60
pop rbx
ret

Function at 0x14008e520
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x48], 0
mov rbx, rcx
and qword [rsp + 0x50], 0
test rcx, rcx
jne 0x14008e560
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov ebx, 0x80004003
mov edx, 0x169
mov r9d, ebx
call fcn.140004f24
jmp 0x14008e623
and dword [rcx], 0
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPasswordLessDevice
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14008e5b2
mov ebx, 0x80070002
cmp edi, ebx
je 0x14008e623
mov edx, 0x174
jmp 0x14008e609
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.DevicePasswordLessBuildVersion
mov dword [rsp + 0x40], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14008e621
mov ebx, 0x80070002
cmp edi, ebx
je 0x14008e623
mov edx, 0x180
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov r9d, edi
call fcn.140004f24
mov ebx, edi
jmp 0x14008e623
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14008e639
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14008f1e8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x48
xor esi, esi
mov dword [rbp + 0x30], 4
lea rax, [rbp + 0x30]
mov dword [rbp + 0x28], esi
mov qword [rsp + 0x30], rax
lea r8, str.ForceDisablePasswordlessNewDevices
lea rax, [rbp + 0x28]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea r9d, [rsi + 0x10]
lea rdx, str.SYSTEMCurrentControlSetControlCryptographyPwdlessPlatImageCustomization
mov qword [rsp + 0x20], rsi
mov dil, sil
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x20]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
movzx r9d, ax
mov edx, 0x273
or r9d, 0x80070000
mov dword [rsp + 0x28], 0x80070002
test eax, eax
mov dword [rsp + 0x20], 1
mov ebx, eax
cmovle r9d, eax
call fcn.14008d8e4
test ebx, ebx
jne 0x14008f282
cmp dword [rbp + 0x28], esi
setne dil
mov r8d, dword [0x1400e8140]
test r8b, 2
jne 0x14008f2a9
lea rdx, [rbp + 0x40]
lea rcx, [0x1400e8140]
call fcn.14008f510
mov rcx, qword [rax]
mov qword [rbp + 0x28], rcx
mov r8d, ecx
mov r9d, r8d
mov dword [rsp + 0x30], 3
mov eax, esi
shr r9d, 9
mov dword [rbp + 0x38], eax
lea rcx, [0x1400e8148]
shr r8d, 8
and r9d, 1
mov byte [rbp + 0x2c], 3
and r8d, 1
movzx eax, word [rbp + 0x2c]
mov edx, 0x1457ebe
mov word [rbp + 0x3c], ax
lea rax, [rbp + 0x38]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x28], esi
call fcn.1400105f0
movzx eax, dil
xor eax, 1
add rsp, 0x48
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14008f314
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov rax, qword [0x1400e6870]
xor rax, rsp
mov qword [rbp + 0x160], rax
and dword [rdx], 0
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionPasswordLessUserConfig_
and dword [rsp + 0x30], 0
mov rsi, rdx
and dword [rsp + 0x44], 0
mov rdi, rcx
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov dword [rsp + 0x40], 4
call fcn.140003680
mov ebx, eax
test eax, eax
jns 0x14008f387
mov edx, 0x28f
jmp 0x14008f39f
mov r8, rdi
lea rcx, [rsp + 0x50]
call fcn.14000370c
mov ebx, eax
test eax, eax
jns 0x14008f3ba
mov edx, 0x291
mov rcx, qword [rbp + 0x178]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov r9d, eax
call fcn.140004f24
jmp 0x14008f4c7
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14008f3ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx edi, ax
mov ebx, 0x80070000
or edi, ebx
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14008f441
mov ebx, 0x80070002
cmp edi, ebx
je 0x14008f4c7
mov edx, 0x295
jmp 0x14008f491
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.PasswordLess
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14008f4ab
mov ebx, 0x80070002
cmp edi, ebx
je 0x14008f4c7
mov edx, 0x299
mov rcx, qword [rbp + 0x178]
lea r8, str.onecoreds_security_baselsapwdlesspolicy_liblibpwdlesspolicy.cxx
mov r9d, edi
call fcn.140004f24
mov ebx, edi
jmp 0x14008f4c7
xor eax, eax
lea ecx, [rax + 2]
cmp dword [rsp + 0x30], ecx
cmove eax, ecx
mov ecx, 1
cmp dword [rsp + 0x30], ecx
cmove eax, ecx
xor ebx, ebx
mov dword [rsi], eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008f4dd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400abb00
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400918fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rdi
sub rsp, 0x38
xor ebx, ebx
lea rax, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 + 0x20], rbx
lea rdx, str.SystemSetup
mov qword [r11 - 0x28], rax
mov rcx, 0xffffffff80000002
lea edi, [rbx + 1]
mov r9d, edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14009199f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Upgrade
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x50], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14009198e
cmp dword [rsp + 0x50], 4
cmove ebx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14009c118
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400e6870]
xor rax, rsp
mov qword [rsp + 0x250], rax
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14009c206
lea r8, str.hvsicontainerservice.dll
lea rcx, [rsp + 0x40]
call fcn.14000370c
test eax, eax
js 0x14009c206
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x14009c1bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CLSIDbfe74cfe_3264_4d44_a930_64b77e14b685
mov rcx, 0xffffffff80000000
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
cmp eax, 2
je 0x14009c206
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop dword [rax + rax]
test eax, eax
je 0x14009c206
mov bl, 1
jmp 0x14009c208
xor bl, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14009c21e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov al, bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400abb00
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x14009c248
Capabilities:
Query or enumerate registry value

Disassembly:
mov byte [rsp + 0x10], dl
mov r11, rsp
sub rsp, 0x48
and dword [rsp + 0x58], 0
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
lea rdx, str.SoftwareMicrosoftHVSI
lea rax, [r11 + 0x10]
mov dword [rsp + 0x60], 4
mov r8, rcx
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
mov r9d, SafeArrayGetLBound
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
jne 0x14009c2a8
cmp dword [rsp + 0x58], eax
seta al
jmp 0x14009c2bc
add eax, 0xfffffffe
cmp eax, 1
jbe 0x14009c2ba
mov rcx, qword [rsp + 0x48]
call fcn.14009bc10
xor al, al
add rsp, 0x48
ret
Function at 0x14009c2c8
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov r11, rsp
push rbx
sub rsp, 0x50
and qword [r11 - 0x18], 0
lea rax, [r11 + 0x18]
and qword [r11 + 0x18], 0
lea rdx, str.SoftwareMicrosoftHVSI
mov qword [r11 - 0x20], rax
mov rbx, rcx
and qword [r11 - 0x28], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14009c326
mov edx, 0x20b
jmp 0x14009c35b
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14009c373
mov edx, 0x20c
mov rcx, qword [rsp + 0x58]
lea r8, str.onecorewindowshvsipolicymanagerlibhvsipolicymanager.cpp
mov r9d, eax
call fcn.14008d814
mov ebx, eax
jmp 0x14009c375
xor ebx, ebx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14009c38b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x14009ee10
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400e6870]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov byte [rdx], 0
xor eax, eax
mov rbx, qword [rcx + 0x88]
mov rdi, rdx
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov dword [rsp + 0x38], eax
lea rdx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
jne 0x14009ee6d
mov rcx, rbx
call fcn.1400a83ec
mov ebx, eax
jmp 0x14009ee6f
xor ebx, ebx
test ebx, ebx
jns 0x14009eea8
mov rcx, qword [0x1400df278]
lea rax, [0x1400df278]
cmp rcx, rax
je 0x14009eea4
test byte [rcx + 0x1c], 1
je 0x14009eea4
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400c56a0]
mov edx, 0x3e
mov r9d, ebx
call fcn.14000a9b0
mov eax, ebx
jmp 0x14009eeb4
cmp dword [rsp + 0x24], 4
sete al
mov byte [rdi], al
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400abb00
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400a0384
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400e6870]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov rax, qword [rcx + 0x148]
xor r9d, r9d
shr rcx, 4
mov r8d, r9d
mov qword [rsp], rcx
mov ecx, r9d
mov rdx, qword [rax + 8]
movups xmm0, xmmword [rdx - 0x10]
movdqu xmmword [rsp + 8], xmm0
movzx eax, byte [rsp + rcx + 8]
inc rcx
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
cmp rcx, 0x10
jb 0x1400a03bd
movzx eax, byte [rsp + r9]
inc r9
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
cmp r9, 8
jb 0x1400a03de
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, 0x6fd91d85
imul r8d, ecx, 0x8001
mul r8d
shr edx, 0x12
imul ecx, edx, 0x927c0
sub r8d, ecx
lea eax, [r8 + 0x927c0]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400abb00
add rsp, 0x28
ret