joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001540
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140001560
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x140001560
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x14006e080
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rdx
cmp rcx, 0xffffffffffffffff
je 0x14006e2aa
lea rax, str.Common_Startup
mov qword [rbp - 0x78], rax
lea rax, str.Startup
mov qword [rbp - 0x70], rax
xor r14d, r14d
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
lea r8d, [r14 + 0x37]
lea rdx, str.MicrosoftWindowsCurrentVersionExplorerShell_Folders
lea rcx, [rsp + 0x68]
call fcn.1400739a0
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14006aab0
movzx ebx, al
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14006e160
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e15b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e2ef
call fcn.140359090
test bl, bl
je 0x14006e2aa
lea rbx, [rbp - 0x78]
nop dword [rax]
mov dword [rsp + 0x60], 0x208
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006e28d
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.1401d6eb0
test al, al
je 0x14006e250
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
xor r8d, r8d
lea rdx, [0x1405e4f00]
lea rcx, [rsp + 0x30]
call fcn.1400739a0
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.14006e300
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14006e250
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e24a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e2e3
call fcn.140359090
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14006e28d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e288
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e2e9
call fcn.140359090
add rbx, 8
lea rax, [rbp - 0x68]
cmp rbx, rax
jne 0x14006e170
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rdi + 0x28]
call fcn.140073b90
lea rcx, [rdi + 8]
call fcn.140073b90
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
int3
Function at 0x140079350
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.140109600
sub eax, 3
je 0x140079391
sub eax, 1
je 0x140079391
cmp eax, 1
je 0x140079391
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140359070
add rsp, 0x88
ret
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x80], rdi
call fcn.1401099b0
test al, al
jne 0x140079430
xor edi, edi
mov dword [rsp + 0x68], 0
lea rax, [rsp + 0x60]
mov word [rsp + 0x6c], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x48], edi
xor r9d, r9d
mov dword [rsp + 0x40], edi
lea r8d, [rdi + 0x12]
mov dword [rsp + 0x38], edi
mov dl, 1
mov dword [rsp + 0x30], edi
xor bl, bl
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14007942c
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
xor ecx, ecx
mov dword [rsp + 0x70], edi
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x14007941d
cmp dword [rsp + 0x70], 1
sete bl
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test bl, bl
jne 0x140079430
xor al, al
jmp 0x140079432
mov al, 1
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140359070
add rsp, 0x88
ret
Function at 0x140084f20
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rcx, qword [str.0cg_]
lea rbp, str.0cg_
cmp rcx, rbp
je 0x140084f79
test byte [rcx + 0x1c], 1
je 0x140084f79
cmp byte [rcx + 0x19], 2
jb 0x140084f79
mov rcx, qword [rcx + 0x10]
lea r9, str.hmpalert
mov edx, 0xb
lea r8, [0x1405f3430]
call fcn.1400786c0
mov r8d, 1
lea rdx, str.ServicesActive
xor ecx, ecx
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140084fec
mov rcx, qword [str.0cg_]
cmp rcx, rbp
je 0x140085133
test byte [rcx + 0x1c], 1
je 0x140085133
cmp byte [rcx + 0x19], 2
jb 0x140085133
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
lea edx, [rsi + 0xc]
lea r9, [0x1405f3548]
mov dword [rsp + 0x20], eax
lea r8, [0x1405f3430]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
jmp 0x140085133
mov r8d, 0x14
mov qword [rsp + 0x70], rdi
lea rdx, str.hmpalert
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140085063
mov rax, qword [str.0cg_]
cmp rax, rbp
je 0x140085125
test byte [rax + 0x1c], 1
je 0x140085125
cmp byte [rax + 0x19], 2
jb 0x140085125
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
lea edx, [rdi + 0xd]
lea r9, str.OpenService
mov dword [rsp + 0x20], eax
lea r8, [0x1405f3430]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
jmp 0x140085125
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400850ad
mov rax, qword [str.0cg_]
cmp rax, rbp
je 0x14008511c
test byte [rax + 0x1c], 1
je 0x14008511c
cmp byte [rax + 0x19], 2
jb 0x14008511c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0xe
lea r9, [0x1405f3580]
jmp 0x140085101
cmp dword [rsp + 0x34], 4
je 0x14008511c
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400850d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x1400850d7
mov bl, 1
jmp 0x14008511c
mov rax, qword [str.0cg_]
cmp rax, rbp
je 0x14008511c
test byte [rax + 0x1c], 1
je 0x14008511c
cmp byte [rax + 0x19], 2
jb 0x14008511c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0xf
lea r9, str.StartService
mov rcx, qword [str.0cg_]
lea r8, [0x1405f3430]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x70]
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret
Function at 0x140085160
Capabilities:
Check for time delay via gettickcount
Query service status
Resolve function by parsing pe exports
Stop service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [str.0cg_]
lea rdi, str.0cg_
cmp rcx, rdi
je 0x1400851ad
test byte [rcx + 0x1c], 1
je 0x1400851ad
cmp byte [rcx + 0x19], 2
jb 0x1400851ad
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f3430]
mov edx, 0x10
call fcn.14007d150
mov r8d, 4
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140085214
mov rax, qword [str.0cg_]
cmp rax, rdi
je 0x14008520d
test byte [rax + 0x1c], 1
je 0x14008520d
cmp byte [rax + 0x19], 2
jb 0x14008520d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
lea edx, [rsi + 0x11]
lea r9, [0x1405f3548]
mov dword [rsp + 0x20], eax
lea r8, [0x1405f3430]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
xor al, al
jmp 0x14008535e
mov rdx, qword [str.hmpalert]
mov r8d, 0x24
mov rcx, rsi
mov qword [rsp + 0x80], rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x14008534b
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400852a6
mov rcx, qword [str.0cg_]
cmp rcx, rdi
je 0x1400852a6
test byte [rcx + 0x1c], 1
je 0x1400852a6
cmp byte [rcx + 0x19], 2
jb 0x1400852a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
lea r9, [0x1405f35c8]
mov dword [rsp + 0x28], eax
lea r8, [0x1405f3430]
mov rax, qword [str.hmpalert]
mov edx, 0x12
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.140084db0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rsp + 0x3c], 3
mov edi, eax
jne 0x140085342
mov qword [rsp + 0x88], rbp
mov ebp, 0x1388
nop word [rax + rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x50]
shr edx, 3
cmp edx, 0x3e8
jae 0x1400852eb
mov edx, 0x3e8
jmp 0x1400852f0
cmp edx, ebp
cmova edx, ebp
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
mov r9d, 0x24
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14008533a
cmp dword [rsp + 0x3c], 1
je 0x14008533a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, dword [0x1406763dc]
ja 0x14008533a
cmp dword [rsp + 0x3c], 3
je 0x1400852d0
mov rbp, qword [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140359070
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140088b00
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
movzx ebx, dx
xor ecx, ecx
lea rdx, [0x1405f3ad8]
mov edi, r9d
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor r8d, r8d
mov r9d, edi
mov rsi, rax
movzx edx, bx
xor eax, eax
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov ebx, eax
test rsi, rsi
je 0x140088b63
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test ebx, ebx
jne 0x140088b73
lea rcx, str.ReportEvent
call fcn.1400892d0
mov rsi, qword [rsp + 0x68]
cmp ebx, 1
mov rbx, qword [rsp + 0x60]
sete al
add rsp, 0x50
pop rdi
ret

Function at 0x140088b90
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xa0]
movzx ebx, dx
lea rdx, [0x1405f3ad8]
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov esi, r9d
movzx edi, r8w
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor edx, edx
mov ecx, 1
mov qword [rsp + 0x40], rdx
mov rbp, rax
lea rax, [rsp + 0x50]
mov r9d, esi
mov qword [rsp + 0x38], rax
movzx r8d, di
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], cx
mov rcx, rbp
mov qword [rsp + 0x20], rdx
movzx edx, bx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov ebx, eax
test rbp, rbp
je 0x140088c1b
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test ebx, ebx
jne 0x140088c2b
lea rcx, str.ReportEvent
call fcn.1400892d0
cmp ebx, 1
sete al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140088c50
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xa0]
movzx ebx, dx
lea rdx, [0x1405f3ad8]
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov esi, r9d
movzx edi, r8w
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor edx, edx
mov ecx, 1
mov qword [rsp + 0x40], rdx
mov rbp, rax
lea rax, [rsp + 0x50]
mov r9d, esi
mov qword [rsp + 0x38], rax
movzx r8d, di
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], cx
mov rcx, rbp
mov qword [rsp + 0x20], rdx
movzx edx, bx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ebx, eax
test rbp, rbp
je 0x140088cdb
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test ebx, ebx
jne 0x140088ceb
lea rcx, str.ReportEvent
call fcn.1400892d0
cmp ebx, 1
sete al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140088d10
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xb8]
movzx ebx, dx
mov rax, qword [rsp + 0xb0]
lea rdx, [0x1405f3ad8]
mov qword [rsp + 0x58], rcx
mov esi, r9d
xor ecx, ecx
mov qword [rsp + 0x50], rax
movzx edi, r8w
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor edx, edx
mov ecx, 2
mov qword [rsp + 0x40], rdx
mov rbp, rax
lea rax, [rsp + 0x50]
mov r9d, esi
mov qword [rsp + 0x38], rax
movzx r8d, di
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], cx
mov rcx, rbp
mov qword [rsp + 0x20], rdx
movzx edx, bx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ebx, eax
test rbp, rbp
je 0x140088da8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test ebx, ebx
jne 0x140088db8
lea rcx, str.ReportEvent
call fcn.1400892d0
cmp ebx, 1
sete al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x140088de0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xb8]
movzx ebx, dx
mov rdx, qword [rsp + 0xc0]
mov esi, r9d
mov rax, qword [rsp + 0xb0]
movzx edi, r8w
mov qword [rsp + 0x60], rdx
lea rdx, [0x1405f3ad8]
mov qword [rsp + 0x58], rcx
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor edx, edx
mov ecx, 3
mov qword [rsp + 0x40], rdx
mov rbp, rax
lea rax, [rsp + 0x50]
mov r9d, esi
mov qword [rsp + 0x38], rax
movzx r8d, di
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], cx
mov rcx, rbp
mov qword [rsp + 0x20], rdx
movzx edx, bx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ebx, eax
test rbp, rbp
je 0x140088e85
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test ebx, ebx
jne 0x140088e95
lea rcx, str.ReportEvent
call fcn.1400892d0
cmp ebx, 1
sete al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400893a0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp byte [0x1406869ec], 0
je 0x1400893dd
mov rdx, qword [0x140686a00]
xor r9d, r9d
mov rcx, qword [0x1406869f8]
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
test eax, eax
jne 0x1400893dd
mov rcx, qword [0x140686a00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1406869f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140686a08]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
Function at 0x14008a0e0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x140686ac8]
xor esi, esi
mov ebx, esi
test rax, rax
je 0x14008a111
mov qword [rsp + 0x20], rax
lea ebx, [rsi + 1]
mov rcx, qword [0x140686a70]
test rcx, rcx
je 0x14008a126
mov eax, ebx
inc ebx
mov qword [rsp + rax*8 + 0x20], rcx
mov rcx, qword [0x140686ad0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test ebx, ebx
je 0x14008a1de
mov qword [rsp + 0x50], rdi
lfence
mov r9d, 0x2710
lea rdx, [rsp + 0x20]
mov r8d, 1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, ebx
test ebx, ebx
je 0x14008a1b3
cmp eax, 0x102
jne 0x14008a199
mov rbx, rsi
nop dword [rax]
mov rcx, qword [rsp + rbx*8 + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14008a191
mov rcx, qword [rsp + rbx*8 + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
inc rbx
cmp rbx, rdi
jl 0x14008a170
mov rbx, rsi
nop dword [rax]
mov rcx, qword [rsp + rbx*8 + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rbx
cmp rbx, rdi
jl 0x14008a1a0
mov rdi, qword [rsp + 0x50]
mov qword [0x140686ac8], rsi
mov qword [0x140686a70], rsi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
mov qword [0x140686ac8], rsi
mov qword [0x140686a70], rsi
jmp 0x14008a1c6
Function at 0x14008d050
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
xor ecx, ecx
mov eax, 1
lock cmpxchg dword [0x1406879b8], ecx
jne 0x14008d10c
mov rdx, qword [0x140686ae8]
test rdx, rdx
je 0x14008d0bb
mov rcx, qword [0x140686ad8]
xor r9d, r9d
mov r8d, 0x7530
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
test eax, eax
je 0x14008d0a1
mov rcx, qword [0x140686ae8]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140686ae8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140686ad8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140686af0]
mov rdx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
test eax, eax
jne 0x14008d0fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14008d0fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_delete_timer_with_error_code__lu
mov ecx, 3
mov r8d, eax
call fcn.140109e80
lea rcx, [0x140686b20]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add rsp, 0x28
ret
Function at 0x14009b240
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [str.0cg_]
lea rdi, str.0cg_
cmp rcx, rdi
je 0x14009b28d
test byte [rcx + 0x1c], 1
je 0x14009b28d
cmp byte [rcx + 0x19], 4
jb 0x14009b28d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f51f0]
mov edx, 0xa
call fcn.14007d150
call fcn.14009b0a0
mov ebx, 1
xor r9d, r9d
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140686b78], rax
test rax, rax
jne 0x14009b2f1
mov rax, qword [str.0cg_]
cmp rax, rdi
je 0x14009b2ed
test byte [rax + 0x1c], bl
je 0x14009b2ed
cmp byte [rax + 0x19], 4
jb 0x14009b2ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
lea edx, [rbx + 0xa]
mov r9d, eax
lea r8, [0x1405f51f0]
mov rcx, qword [rcx + 0x10]
call fcn.140082b10
xor al, al
jmp 0x14009b32b
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x14009cb60]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140686b80], rax
call fcn.14009ce50
xchg dword [0x140687a70], ebx
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14009b350
Capabilities:
Terminate thread

Disassembly:
push rbp
sub rsp, 0x20
mov rcx, qword [str.0cg_]
lea rax, str.0cg_
cmp rcx, rax
je 0x14009b38a
test byte [rcx + 0x1c], 1
je 0x14009b38a
cmp byte [rcx + 0x19], 4
jb 0x14009b38a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f51f0]
mov edx, 0xc
call fcn.14007d150
xor ebp, ebp
mov eax, 1
lock cmpxchg dword [0x140687a70], ebp
jne 0x14009b490
mov rdx, qword [0x140686b80]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
test rdx, rdx
je 0x14009b3f5
mov rcx, qword [0x140686b78]
xor r9d, r9d
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x14009b3e1
mov rcx, qword [0x140686b80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140686b80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140686b80], rbp
mov rcx, qword [0x140686b78]
test rcx, rcx
je 0x14009b40e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140686b78], rbp
lea rcx, [0x140686b88]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rsi, qword [0x140687a80]
mov rdi, qword [rsi + 8]
cmp byte [rdi + 0x19], bpl
jne 0x14009b46f
mov qword [rsp + 0x30], rbx
mov r8, qword [rdi + 0x10]
lea rdx, [0x140687a80]
lea rcx, [0x140687a80]
call fcn.14009da50
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.1400782e0
mov edx, 0x30
mov rcx, rbx
call fcn.140359090
cmp byte [rdi + 0x19], bpl
je 0x14009b431
mov rbx, qword [rsp + 0x30]
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov qword [rsi + 0x10], rsi
mov qword [0x140687a88], rbp
call fcn.14009d120
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov al, 1
add rsp, 0x20
pop rbp
ret