joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d0c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.14002d820
lea rdx, [rsp + 0x20]
lea rcx, str._SYSTEMDRIVE_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x104
jbe 0x14000d11e
xor al, al
jmp 0x14000d16d
test rbx, rbx
je 0x14000d127
lea rdi, [rbx + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000b9b0
lea rdx, str.Intel
mov rcx, rax
call fcn.14000b9b0
lea rdx, str.Logs
mov rcx, rax
call fcn.14000b9b0
lea rdx, str.IntelCpHDCPSvc.log
mov rcx, rax
call fcn.14000b9b0
xor edx, edx
mov rcx, rax
call fcn.140010690
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14002d7f0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x14000d440
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x14000d5a5
cmp byte [rcx + 0x82], 0
je 0x14000d5a5
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x14000d49b
xor al, al
jmp 0x14000d5a7
mov qword [rsp + 0x58], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x40]
call fcn.14000e990
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
cmovae r8, qword [rsp + 0x40]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rsp + 0x50]
add r9, rdx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x14000d50e
dec eax
jne 0x14000d583
jmp 0x14000d515
mov byte [rdi + 0x82], 0
lea rax, [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
cmp r10, 0x10
cmovae rax, r9
mov rbx, qword [rsp + 0x38]
sub rbx, rax
je 0x14000d55c
lea rcx, [rsp + 0x40]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.14002f1b0
cmp rbx, rax
jne 0x14000d588
cmp byte [rdi + 0x82], 0
je 0x14000d58c
test rbx, rbx
jne 0x14000d4c4
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.14000e870
jmp 0x14000d4c4
sub eax, 2
je 0x14000d58c
xor bl, bl
jmp 0x14000d58e
mov bl, 1
cmp qword [rsp + 0x58], 0x10
jb 0x14000d5a0
mov rcx, qword [rsp + 0x40]
call fcn.14002d02c
movzx eax, bl
jmp 0x14000d5a7
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002d7f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140010370
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r14d, dx
mov rbx, rcx
mov esi, 0xffff
cmp si, dx
jne 0x1400103ba
xor eax, eax
jmp 0x140010588
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400103f7
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1400103f7
lea ecx, [r9 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], r14w
movzx eax, r14w
jmp 0x140010588
cmp qword [rcx + 0x90], 0
je 0x140010585
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x80]
cmp qword [r8], rax
jne 0x140010433
mov rdx, qword [rcx + 0x70]
mov rcx, qword [rcx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub rdx, rcx
sar rdx, 1
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x14001045c
mov rdx, qword [rbx + 0x90]
movzx ecx, r14w
call fcn.14002f92c
cmp ax, si
je 0x140010585
movzx esi, r14w
jmp 0x140010585
mov word [rbp - 1], r14w
mov qword [rbp + 0x1f], reloc.OLEAUT32.dll_SafeArrayDestroy
xor eax, eax
mov qword [rbp + 0x17], rax
mov byte [rbp + 7], al
xor r8d, r8d
lea edx, [rax + 8]
lea rcx, [rbp + 7]
call fcn.14000e990
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 1]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x140010575
cmp eax, 1
jg 0x140010557
lea rax, [rbp + 7]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x1f]
cmp r10, 0x10
cmovae rax, r9
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x140010522
lea rcx, [rbp + 7]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.14002f1b0
cmp rdi, rax
jne 0x140010575
mov byte [rbx + 0x82], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x140010571
test rdi, rdi
jne 0x140010482
cmp qword [rbp + 0x17], 0x20
jae 0x140010575
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.14000e870
jmp 0x140010482
cmp eax, 3
jne 0x140010575
mov rdx, qword [rbx + 0x90]
movzx ecx, word [rbp - 1]
call fcn.14002f92c
cmp ax, si
je 0x140010575
movzx esi, r14w
cmp qword [rbp + 0x1f], 0x10
jb 0x140010585
mov rcx, qword [rbp + 7]
call fcn.14002d02c
movzx eax, si
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14002d7f0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012d60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140012d8e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140016900
cmp byte [0x14006a220], 0
jne 0x140012dd9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012dc9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14006a220], 1
mov qword [0x14006a218], rax
jmp 0x140012de0
mov rax, qword [0x14006a218]
mov byte [0x14006a220], 1
jmp 0x140012de0
mov rax, qword [0x14006a218]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140012dff
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140016974
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14001698f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14001698f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x14001698f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
wait
mov cl, 0x2a
lea ebx, [rax]
invalid
Function at 0x140014150
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.140014430
test eax, eax
je 0x140014181
mov eax, 1
jmp 0x140014288
lea rdx, [rsp + 0x72]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001437e
cmp eax, 0x104
je 0x14001437e
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x1400143c7
mov qword [rsp + 0xaa8], rbx
mov qword [rsp + 0xab0], rsi
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400142a1
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80a
call fcn.140011f10
test eax, eax
jne 0x14001425f
lea r8, str.Could_not_open_Service_Manager
lea rcx, [rsp + 0x280]
mov edx, 0x400
call fcn.140030728
test eax, eax
je 0x14001425f
cmp eax, 0xc
je 0x14001439b
cmp eax, 0x16
je 0x140014390
cmp eax, 0x22
je 0x140014390
cmp eax, 0x50
jne 0x140014385
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14002d7f0
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
add rdi, 0x68
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140014362
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80b
call fcn.140011f10
test eax, eax
jne 0x140014357
lea r8, str.Could_not_start_service
lea rcx, [rsp + 0x280]
mov edx, 0x400
call fcn.140030728
test eax, eax
je 0x140014357
cmp eax, 0xc
je 0x1400143bc
cmp eax, 0x16
je 0x1400143b1
cmp eax, 0x22
je 0x1400143b1
cmp eax, 0x50
jne 0x1400143a6
xor r9d, r9d
mov r8, rdi
jmp 0x140014266
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140014278
xor eax, eax
jmp 0x140014288
mov ecx, 0x80004005
call fcn.140007020
int3
mov ecx, 0x80070057
call fcn.140007020
int3
mov ecx, 0x8007000e
call fcn.140007020
int3
mov ecx, 0x80004005
call fcn.140007020
int3
mov ecx, 0x80070057
call fcn.140007020
int3
mov ecx, 0x8007000e
call fcn.140007020
int3
call fcn.140030560
int3
Function at 0x140016660
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.140014820
mov ebx, eax
test eax, eax
jne 0x140016787
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140016761
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140016660
mov ebx, eax
test eax, eax
jne 0x140016787
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140016710
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140016776
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.140012d60
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140016797
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14002d7f0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016900
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140012d8e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140016900
cmp byte [0x14006a220], 0
jne 0x140012dd9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012dc9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14006a220], 1
mov qword [0x14006a218], rax
jmp 0x140012de0
mov rax, qword [0x14006a218]
mov byte [0x14006a220], 1
jmp 0x140012de0
mov rax, qword [0x14006a218]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140012dff
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140016974
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14001698f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14001698f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x14001698f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
wait
mov cl, 0x2a
lea ebx, [rax]
invalid
Function at 0x140016b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.14002d820
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140016c3c
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140016c3c
call fcn.140011ee0
mov ebx, eax
jmp 0x140016d64
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140016c5d
call fcn.140011ee0
jmp 0x140016d53
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140016c80
call fcn.140011ee0
jmp 0x140016d53
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140016ca2
mov ebx, 0x8007000e
jmp 0x140016d55
mov ecx, eax
test eax, eax
je 0x140016cda
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140016cd0
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140016cda
lea rcx, [rsp + 0x70]
call fcn.140011d50
jmp 0x140016ce4
mov ecx, 0x80070216
call fcn.140007020
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140016cf7
cmp qword [rsp + 0x70], 0
jne 0x140016d06
mov ebx, 0x8007000e
jmp 0x140016d55
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140016d30
call fcn.140011ee0
jmp 0x140016d53
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.1400169b0
mov ebx, eax
test rdi, rdi
je 0x140016d64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140016d7b
lea rcx, [rsp + 0x70]
call fcn.140012e50
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14002d7f0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140017c40
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002d7f0
add rsp, 0x48
ret

Function at 0x140017d40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
lea rdx, str.LaunchPermission
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], 0
mov esi, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x140017dc3
lea r9d, [rax + 1]
lea rdx, str.LaunchPermission
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140017dc3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x140018340
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x140018358
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140018364
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x140018360
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x140018510
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor eax, eax
xor r12d, r12d
mov rdi, rcx
mov r15d, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x48]
lea r8, str.AppID
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x58], r12
call fcn.140014820
mov ebx, eax
test eax, eax
je 0x140018597
mov dword [rdi + 0x27c], eax
jmp 0x1400186fa
mov rdx, qword [rsp + 0x48]
xor eax, eax
lea r8, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x40], r12
call fcn.140014820
mov ebx, eax
test eax, eax
jne 0x1400186e2
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
lea rdx, str.LocalService
xor r8d, r8d
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x14001864e
mov eax, dword [rsp + 0x64]
dec eax
cmp eax, 1
jbe 0x140018628
lea ecx, [rbx + 0xd]
jmp 0x14001864e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140018646
test al, 1
jne 0x14001863f
shr rax, 1
cmp word [rbp + rax*2 - 0x72], r12w
je 0x14001864b
mov ecx, SafeArrayGetDim
jmp 0x14001864e
mov word [rbp - 0x70], r12w
mov ecx, r12d
test ecx, ecx
mov eax, r12d
mov edx, 1
cmove eax, edx
mov dword [rdi + 0x28c], eax
test eax, eax
je 0x1400186a6
lea rax, [rdi + 0x68]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x68], rax
lea rax, [0x14001a490]
mov qword [rbp - 0x80], r12
mov qword [rsp + 0x70], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14001869e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x27c], eax
mov ebx, dword [rdi + 0x27c]
jmp 0x1400186e8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x1400186d1
cmp eax, 0x80010106
jne 0x1400186e8
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400186d5
jmp 0x1400186e8
mov byte [rdi + 0x62], 1
mov edx, r15d
mov rcx, rdi
call fcn.140017500
mov ebx, eax
mov dword [rdi + 0x27c], eax
cmp qword [rsp + 0x30], r12
je 0x1400186fa
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x48], r12
je 0x14001870c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14002d7f0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rbp
ret
Function at 0x140019560
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x58
call fcn.140019100
test eax, eax
jne 0x140019577
mov eax, 0x80004005
add rsp, 0x58
ret
xor eax, eax
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r8, str.AppID
lea rcx, [rsp + 0x38]
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
call fcn.140014820
test eax, eax
je 0x1400195ca
mov ecx, eax
call fcn.140011f00
mov ebx, eax
jmp 0x140019640
mov rdx, qword [rsp + 0x38]
xor eax, eax
lea r8, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov r9d, 0x20006
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], rbx
call fcn.140014820
test eax, eax
je 0x140019612
mov ecx, eax
call fcn.140011f00
jmp 0x14001962b
mov rcx, qword [rsp + 0x20]
lea rdx, str.LocalService
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
call fcn.140019bd0
cmp qword [rsp + 0x20], 0
mov ebx, eax
je 0x140019640
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x38], 0
je 0x140019653
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret