joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ede0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140087710]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.14002e660
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str._SYSTEMDRIVE_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x104
jbe 0x14000ee33
xor al, al
jmp 0x14000ee83
xor eax, eax
lea rcx, [rbx + 0x10]
test rbx, rbx
lea rdx, [rsp + 0x20]
cmove rcx, rax
call fcn.14000d4a0
mov rcx, rax
lea rdx, str.Intel
call fcn.14000d4a0
mov rcx, rax
lea rdx, str.Logs
call fcn.14000d4a0
mov rcx, rax
lea rdx, str.IntelCpHDCPSvc.log
call fcn.14000d4a0
xor edx, edx
mov rcx, rax
call fcn.1400129a0
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14002ad40
add rsp, 0x240
pop rbx
ret
Function at 0x14000f150
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140087710]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
cmp qword [rcx + 0x68], 0
je 0x14000f320
cmp byte [rcx + 0x72], 0
je 0x14000f320
mov rax, qword [rcx]
mov edi, 0xffff
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.14000b400]
movzx edx, di
mov rcx, r15
call rbx
cmp di, ax
jne 0x14000f1c1
xor al, al
jmp 0x14000f322
mov qword [rbp - 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 0x20], 0
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.140010a40
nop
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
nop
lea r9, [rbp - 0x30]
cmp rdx, 0x10
cmovae r9, rcx
lea r14, [rbp - 0x30]
cmovae r14, rcx
mov rsi, qword [r15 + 0x68]
mov rdx, qword [rsi]
mov rbx, qword [rbp - 0x20]
add rbx, r9
mov rdi, qword [rdx + 0x40]
mov rcx, rdi
call qword [fcn.14000b400]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r14
lea rdx, [r15 + 0x74]
mov rcx, rsi
call rdi
test eax, eax
je 0x14000f242
sub eax, 1
jne 0x14000f2b8
jmp 0x14000f247
mov byte [r15 + 0x72], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x14000f294
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, rcx
mov r9, qword [r15 + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.14003589c
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x14000f2c5
cmp byte [r15 + 0x72], 0
je 0x14000f2c9
test rbx, rbx
jne 0x14000f1f0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.140010930
jmp 0x14000f1e6
sub eax, 2
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x14000f2c9
xor bl, bl
jmp 0x14000f2cb
mov bl, 1
cmp rdx, 0x10
jb 0x14000f31b
lea rax, [rdx + 1]
cmp rax, 0x1000
jb 0x14000f316
test byte [rbp - 0x30], 0x1f
je 0x14000f2e9
call fcn.140031240
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000f2f8
call fcn.140031240
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000f307
call fcn.140031240
int3
cmp rcx, 0x27
jbe 0x14000f313
call fcn.140031240
int3
mov rcx, rax
call fcn.14002ae84
movzx eax, bl
jmp 0x14000f322
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002ad40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400152e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001530e
mov r8, rdx
mov rdx, qword [rdi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140019440
cmp byte [0x14008a7b8], 0
mov qword [rsp + 0x30], rbx
jne 0x140015361
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140015351
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x14008a7b0], rax
mov byte [0x14008a7b8], 1
jmp 0x140015368
mov rbx, qword [0x14008a7b0]
mov byte [0x14008a7b8], 1
jmp 0x140015368
mov rbx, qword [0x14008a7b0]
test rbx, rbx
je 0x140015398
mov rcx, rbx
call qword [fcn.14000b400]
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
mov rcx, qword [rdi]
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400194b7
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400194cb
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400194cb
mov rcx, rax
call qword [fcn.14000b400]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x1400194d0
cmp dword [rcx + 8], 0
je 0x1400194cb
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400194d0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140016950
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x140087710]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.140016c30
test eax, eax
je 0x140016981
mov eax, 1
jmp 0x140016a88
mov r8d, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140016b7e
cmp eax, 0x104
je 0x140016b7e
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x140016bc7
mov qword [rsp + 0xaa8], rbx
xor edx, edx
mov qword [rsp + 0xab0], rsi
mov r8d, 0xf003f
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140016aa1
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
call fcn.1400143d0
test eax, eax
jne 0x140016a5f
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140036008
test eax, eax
je 0x140016a5f
cmp eax, 0xc
je 0x140016b9b
cmp eax, 0x16
je 0x140016b90
cmp eax, 0x22
je 0x140016b90
cmp eax, 0x50
jne 0x140016b85
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14002ad40
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x58], rsi
add rdi, 0x68
mov qword [rsp + 0x50], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rsi
mov r8, rdi
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140016b62
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80b
call fcn.1400143d0
test eax, eax
jne 0x140016b57
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140036008
test eax, eax
je 0x140016b57
cmp eax, 0xc
je 0x140016bbc
cmp eax, 0x16
je 0x140016bb1
cmp eax, 0x22
je 0x140016bb1
cmp eax, 0x50
jne 0x140016ba6
xor r9d, r9d
mov r8, rdi
jmp 0x140016a66
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140016a78
xor eax, eax
jmp 0x140016a88
mov ecx, 0x80004005
call fcn.140007bb0
int3
mov ecx, 0x80070057
call fcn.140007bb0
int3
mov ecx, 0x8007000e
call fcn.140007bb0
int3
mov ecx, 0x80004005
call fcn.140007bb0
int3
mov ecx, 0x80070057
call fcn.140007bb0
int3
mov ecx, 0x8007000e
call fcn.140007bb0
int3
call fcn.14002b644
int3
Function at 0x140019160
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140087710]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
mov qword [rsp + 0x40], rdx
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov edi, dword [rsi + 8]
mov dword [rsp + 0x50], ecx
or edi, 0x2001f
mov qword [rsp + 0x58], rcx
mov r9d, edi
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400192b7
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400191e8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x1400192b7
xor edi, edi
mov dword [rsp + 0x68], 0x100
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001928f
nop dword [rax]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.140019160
mov ebx, eax
test eax, eax
jne 0x1400192b7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x68], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140019240
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400192a4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.1400152e0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400192c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14002ad40
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019440
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001530e
mov r8, rdx
mov rdx, qword [rdi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140019440
cmp byte [0x14008a7b8], 0
mov qword [rsp + 0x30], rbx
jne 0x140015361
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140015351
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x14008a7b0], rax
mov byte [0x14008a7b8], 1
jmp 0x140015368
mov rbx, qword [0x14008a7b0]
mov byte [0x14008a7b8], 1
jmp 0x140015368
mov rbx, qword [0x14008a7b0]
test rbx, rbx
je 0x140015398
mov rcx, rbx
call qword [fcn.14000b400]
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
mov rcx, qword [rdi]
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400194b7
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400194cb
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400194cb
mov rcx, rax
call qword [fcn.14000b400]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x1400194d0
cmp dword [rcx + 8], 0
je 0x1400194cb
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400194d0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140019880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140087710]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.14002e660
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140019920
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140019920
call fcn.1400143a0
mov ebx, eax
jmp 0x140019a48
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140019941
call fcn.1400143a0
jmp 0x140019a37
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140019964
call fcn.1400143a0
jmp 0x140019a37
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140019986
mov ebx, 0x8007000e
jmp 0x140019a39
mov ecx, eax
test eax, eax
je 0x1400199be
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400199b4
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1400199be
lea rcx, [rsp + 0x70]
call fcn.140014130
jmp 0x1400199c8
mov ecx, 0x80070216
call fcn.140007bb0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1400199db
cmp qword [rsp + 0x70], 0
jne 0x1400199ea
mov ebx, 0x8007000e
jmp 0x140019a39
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140019a14
call fcn.1400143a0
jmp 0x140019a37
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.1400195d0
mov ebx, eax
test rdi, rdi
je 0x140019a48
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140019a5f
lea rcx, [rsp + 0x70]
call fcn.140015400
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14002ad40
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001ac80
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140087710]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002ad40
add rsp, 0x48
ret

Function at 0x14001ad80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, str.LaunchPermission
mov rcx, rdi
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x14001ae03
mov dword [rsp + 0x28], esi
lea r9d, [rax + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.LaunchPermission
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14001ae03
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001b550
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x14001b568
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x14001b574
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x14001b570
mov rcx, qword [rcx]
mov rdx, r10
mov dword [rsp + 0x28], r8d
xor r8d, r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x14001b740
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x290
mov rax, qword [0x140087710]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14d, edx
lea rax, [rsp + 0x40]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor edi, edi
lea rdx, str.AppID
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x40], rdi
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001b7a1
mov dword [rbx + 0x27c], eax
jmp 0x14001b8d8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x2c0], rsi
lea rdx, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov rsi, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b8a1
mov rsi, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LocalService
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x14001b853
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
jbe 0x14001b82f
mov ecx, SafeArrayGetDim
jmp 0x14001b853
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14001b84c
test al, 1
jne 0x14001b845
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], di
je 0x14001b851
mov ecx, SafeArrayGetDim
jmp 0x14001b853
mov word [rsp + 0x70], di
mov ecx, edi
test ecx, ecx
mov eax, edi
mov edx, 1
cmove eax, edx
mov dword [rbx + 0x28c], eax
test eax, eax
je 0x14001b8f4
lea rax, [rbx + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
lea rax, [0x14001d6d0]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14001b8a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x27c], eax
mov edi, dword [rbx + 0x27c]
test rsi, rsi
je 0x14001b8bb
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x40], 0
mov rsi, qword [rsp + 0x2c0]
je 0x14001b8d6
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14002ad40
add rsp, 0x290
pop r14
pop rdi
pop rbx
ret
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
test eax, eax
jns 0x14001b91f
cmp eax, 0x80010106
jne 0x14001b8ad
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14001b923
jmp 0x14001b8ad
mov byte [rbx + 0x62], 1
mov edx, r14d
mov rcx, rbx
call fcn.14001a320
mov edi, eax
mov dword [rbx + 0x27c], eax
jmp 0x14001b8ad
Function at 0x14001c7c0
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140087710]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.14001c360
test eax, eax
jne 0x14001c7f3
mov eax, 0x80004005
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002ad40
add rsp, 0x58
ret
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rdx, str.AppID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c835
mov ecx, eax
call fcn.1400143c0
mov ebx, eax
jmp 0x14001c8af
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
lea rdx, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c86e
mov ecx, eax
call fcn.1400143c0
mov ebx, eax
jmp 0x14001c89c
mov rcx, qword [rsp + 0x30]
lea rdx, str.LocalService
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
call fcn.14001cea0
cmp qword [rsp + 0x30], 0
mov ebx, eax
je 0x14001c89c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x38], 0
je 0x14001c8af
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002ad40
add rsp, 0x58
ret
Function at 0x1400262a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
lea rdx, str.CSecureChannelMELSPCON::Initialize
lea rcx, str.ENTER_______s_n
call fcn.140021bd0
call fcn.14001e650
mov qword [rsi], rax
test rax, rax
jne 0x1400262f5
mov r8d, 0x19b
lea rdx, str.CSecureChannelMELSPCON::Initialize
lea rcx, str._s:_d:_ERROR:_Create_Escape_Call_failed_n
call fcn.140021bd0
mov ebx, 0x80004005
jmp 0x1400264ad
mov rcx, rsi
call fcn.140026e50
mov ebx, eax
test eax, eax
jns 0x140026315
mov r8d, 0x1a3
lea rcx, str._s:_d:_ERROR:_QueryForLSPCON_failed_n
jmp 0x14002647a
cmp dword [rsi + 0x18], 0
lea rdx, str.CSecureChannelMELSPCON::Initialize
jne 0x140026331
mov r8d, 0x1a8
lea rcx, str._s:_d:_ERROR:_LSPCON_not_detected_n
jmp 0x140026345
mov dword [rsi + 0x70], 1
lea rcx, str._s:_d:_LSPCON_detected_n
mov r8d, 0x1af
call fcn.140021bd0
xor edi, edi
lea rbx, [rsi + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx], rax
test rax, rax
je 0x14002648c
inc edi
add rbx, 8
cmp edi, 5
jl 0x140026350
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x50], rax
test rax, rax
jne 0x1400263b3
mov r8d, 0x1c4
lea rdx, str.CSecureChannelMELSPCON::Initialize
lea rcx, str._s:_d:_m_hTaskDone_CreateEvent_failed__n
call fcn.140021bd0
mov ebx, 0x80004005
jmp 0x1400264ad
mov rcx, rsi
call fcn.1400261b0
mov ebx, eax
test eax, eax
jns 0x1400263ea
mov r9d, eax
lea rdx, str.CSecureChannelMELSPCON::Initialize
mov r8d, 0x1cc
lea rcx, str._s:_d:_InitOPMPath_Failed_hr_:__d_n
call fcn.140021bd0
mov rcx, rsi
call fcn.1400252b0
jmp 0x140026486
mov qword [rsp + 0x28], 0
lea r8, [0x140026d00]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x58], rax
test rax, rax
jne 0x140026438
mov r8d, 0x1dc
lea rdx, str.CSecureChannelMELSPCON::Initialize
lea rcx, str._s:_d:_Create_listening_thread_failed__n
call fcn.140021bd0
mov ebx, 0x80004005
jmp 0x1400264ad
call fcn.140003740
mov qword [rsi + 0x10], rax
test rax, rax
jne 0x140026469
mov r8d, 0x1e5
lea rdx, str.CSecureChannelMELSPCON::Initialize
lea rcx, str._s:_d:_ERROR:_m_pEventHandler_is_NULL_n
call fcn.140021bd0
mov rcx, rsi
call fcn.1400252b0
jmp 0x140026486
mov byte [rsi + 0x64], 1
lea rcx, str._s:_d:_Init_Successful__n
mov r8d, 0x1ea
lea rdx, str.CSecureChannelMELSPCON::Initialize
call fcn.140021bd0
test ebx, ebx
je 0x1400264d3
jmp 0x1400264ad
mov r9d, edi
lea rdx, str.CSecureChannelMELSPCON::Initialize
mov r8d, 0x1b8
lea rcx, str._s:_d:_m_hEvents_creation_failed___number_:_d__n
mov ebx, 0x80004005
call fcn.140021bd0
mov r8d, 0x1ef
lea rdx, str.CSecureChannelMELSPCON::Initialize
lea rcx, str._s:_d:_Init_Failed__n
call fcn.140021bd0
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400264d3
call fcn.14001e950
mov r8d, ebx
lea rdx, str.CSecureChannelMELSPCON::Initialize
lea rcx, str.EXIT________s:_ret__0x_x_n
call fcn.140021bd0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret