joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f2db0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x50], r14d
mov qword [rbp - 0x18], r14
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.1401ff260
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
lea r9d, [r14 + 9]
lea r8, [0x14034ee78]
mov rcx, qword [rbp - 0x20]
call fcn.1402bd21c
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.140200570
nop
lea edx, [r14 + 0x26]
lea rcx, [rbp - 0x10]
call fcn.14020a8a0
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400d2bd0
nop
cmp dword [rbp - 8], r14d
jle 0x1400f2e4a
mov rcx, qword [rbp - 0x10]
call fcn.1402b9c20
nop
cmp dword [rbp - 0x18], 0
jle 0x1400f2e59
mov rcx, qword [rbp - 0x20]
call fcn.1402b9c20
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
call fcn.140201da0
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f2e8a
test al, 0x10
je 0x1400f2e8a
cmp dword [rbp - 0x28], 0
jle 0x1400f2ea8
mov rcx, qword [rbp - 0x30]
call fcn.1402b9c20
jmp 0x1400f2ea8
cmp dword [rbp - 0x28], 0
jle 0x1400f2e99
mov rcx, qword [rbp - 0x30]
call fcn.1402b9c20
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test rsi, rsi
je 0x1400f2f20
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400f2eb1
mov qword [rbp - 0x28], r14
test ebx, ebx
jne 0x1400f2ed0
lea rax, [0x140348ca0]
mov qword [rbp - 0x30], rax
jmp 0x1400f2ef2
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x30]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140200570
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.1400d2bd0
nop
cmp dword [rbp - 0x28], 0
jle 0x1400f2f63
mov rcx, qword [rbp - 0x30]
call fcn.1402b9c20
jmp 0x1400f2f63
mov qword [rdi + 8], r14
mov edx, dword [rbp - 0x34]
test edx, edx
jne 0x1400f2f37
lea rax, [0x140348ca0]
mov qword [rdi], rax
jmp 0x1400f2f5a
mov rcx, rdi
call fcn.1401ff260
movsxd r9, dword [rbp - 0x34]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [rdi]
call fcn.1402bd21c
mov edx, dword [rbp - 0x34]
mov rcx, rdi
call fcn.140200570
nop
cmp dword [rbp - 0x38], 0
jle 0x1400f2f72
mov rcx, qword [rbp - 0x40]
call fcn.1402b9c20
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400f3690
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x78
xor edx, edx
mov rbx, rcx
xor r8d, r8d
lea ecx, [rdx + 6]
mov sil, 1
call fcn.1400ce2e0
test al, al
je 0x1400f3803
cmp byte [rbx + 0x225], 0
mov qword [rsp + 0x70], rdi
jne 0x1400f375f
xor ecx, ecx
call fcn.1400f2f90
mov rdi, rax
test rax, rax
je 0x1400f375f
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
lea rdx, str.NoSSL
xor r8d, r8d
mov dword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f373c
cmp dword [rsp + 0x98], ebx
sete sil
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
test sil, sil
jne 0x1400f375f
movzx eax, sil
mov rdi, qword [rsp + 0x70]
add rsp, 0x78
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x40]
call fcn.1400caec0
lea rcx, [rsp + 0x58]
call fcn.1400cafe0
mov ecx, dword [rax + 0x10]
cmp ecx, dword [rsp + 0x50]
jne 0x1400f3797
mov rax, qword [rax + 8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
jmp 0x1400f37db
test ecx, ecx
jne 0x1400f37bc
lea rcx, [rax + 8]
lea rdx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
jmp 0x1400f37db
mov rax, qword [rax + 8]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov rdi, qword [rsp + 0x70]
cmp eax, 0xffffffff
sete al
add rsp, 0x78
pop rsi
pop rbx
ret
mov eax, dword [0x14042c9e0]
test al, 1
jne 0x1400f383b
or eax, 1
lea rcx, [0x1403017d0]
mov qword [0x14042c9f0], 0xffffffff80000002
mov dword [0x14042c9e0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x14042c9e8], rax
call fcn.1402bb344
lea rdx, [0x14034ee50]
lea rcx, [0x14042c9e8]
call fcn.1400eb8d0
mov rbx, rax
test rax, rax
je 0x1400f389e
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x28], 4
lea rdx, str.NoSSL
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x98], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
xor al, al
add rsp, 0x78
pop rsi
pop rbx
ret
Function at 0x1400f38b0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor eax, eax
test dl, dl
movzx edi, dl
setne al
mov dword [rcx + 0x100], eax
mov eax, dword [0x14042c9e0]
test al, 1
jne 0x1400f3902
or eax, 1
lea rcx, [0x1403017d0]
mov qword [0x14042c9f0], 0xffffffff80000002
mov dword [0x14042c9e0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x14042c9e8], rax
call fcn.1402bb344
lea rdx, [0x14034ee50]
lea rcx, [0x14042c9e8]
call fcn.1400eb8d0
mov rbx, rax
test rax, rax
je 0x1400f3977
lea rdx, str.EarlyWarning
test dil, dil
je 0x1400f3958
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400f396a
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f3990
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movaps xmmword [rax - 0x38], xmm6
movzx esi, dl
mov rbx, rcx
xor r12d, r12d
mov eax, dword [0x14041c4a0]
cmp eax, 0xffffffff
jne 0x1400f39f9
call fcn.140113300
test al, al
je 0x1400f39e7
mov edi, 1
mov dword [0x14041c4a0], edi
jmp 0x1400f3be2
cmp qword [rbx + 0x2f0], r12
jne 0x1400f39d7
mov dword [0x14041c4a0], r12d
jmp 0x1400f3a02
cmp eax, 1
je 0x1400f3be2
cmp qword [rbx + 0x268], r12
jne 0x1400f3bde
mov edi, 1
xor eax, eax
lock cmpxchg dword [rbx + 0x108], edi
jne 0x1400f3be2
call fcn.140113110
test al, al
je 0x1400f3be2
mov byte [rbx + 0x32], sil
call fcn.140106470
test al, al
jne 0x1400f3be2
xor r14b, r14b
test sil, sil
jne 0x1400f3b83
xor ecx, ecx
call fcn.1400f2f90
mov rsi, rax
test rax, rax
je 0x1400f3b83
lea rax, [0x140348ca0]
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], r12
lea r8, [rbp - 0x11]
lea rdx, str.LastCFU
mov rcx, rsi
call fcn.1400d8b50
test al, al
je 0x1400f3b64
lea rax, vtable.Core::DateTime.0
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], r12
mov dword [rbp + 0x1f], edi
cmp dword [rbp - 5], 0x13
jl 0x1400f3b64
mov qword [rbp - 0x19], r12
lea edx, [rdi + 0x12]
lea rcx, [rbp - 0x21]
call fcn.1401ff260
mov eax, dword [rbp - 0x19]
inc eax
movsxd rdx, eax
lea r9d, [rdi + 0x12]
lea r8, str.yyyy_MM_dd_HH:mm:ss
mov rcx, qword [rbp - 0x21]
call fcn.1402bd21c
lea edx, [rdi + 0x12]
lea rcx, [rbp - 0x21]
call fcn.140200570
nop
xor r9d, r9d
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp - 0x11]
call fcn.1400eaec0
test al, al
sete r15b
cmp dword [rbp - 0x19], 0
jle 0x1400f3b09
mov rcx, qword [rbp - 0x21]
call fcn.1402b9c20
test r15b, r15b
jne 0x1400f3b64
call fcn.140114e00
mov rcx, rax
lea r8, [rbp + 0xf]
lea rdx, [rbp - 1]
call fcn.1400cb050
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rbp + 7]
movaps xmm1, xmm6
divsd xmm1, qword [0x140374960]
movq rdx, xmm1
lea rcx, str.LastCFU__3.1f_mins_ago_n
call fcn.1402ba358
divsd xmm6, qword [0x140374980]
movzx r14d, r14b
movsd xmm0, qword [0x1403747f8]
comisd xmm0, xmm6
cmova r14d, edi
mov rax, qword [rsi]
mov edx, edi
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp - 9], 0
jle 0x1400f3b7e
mov rcx, qword [rbp - 0x11]
call fcn.1402b9c20
test r14b, r14b
jne 0x1400f3be2
mov dword [rbp + 0x77], r12d
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x1400f3c10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x268], rax
test rax, rax
je 0x1400f3be2
mov eax, dword [rbx + 0x218]
mov dword [rbx + 0x21c], eax
mov edx, 4
mov rcx, rbx
call fcn.1400f5260
mov rcx, qword [rbx + 0x268]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
jmp 0x1400f3be4
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400f5b40
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
lea r14, [0x140348ca0]
mov qword [rbp - 0x28], r14
xor esi, esi
mov qword [rbp - 0x20], rsi
mov edx, 0x258
xor ecx, ecx
lea r8d, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f5d55
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400fc010
test al, al
je 0x1400f5d55
cmp dword [rbp - 0x1c], esi
je 0x1400f5d55
mov rbx, qword [rbp - 0x28]
lea r8d, [rsi + 0xa]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.1402bd030
mov edi, eax
mov rdx, qword [rbp + 0x20]
sub rdx, rbx
sar rdx, 1
movsxd rcx, dword [rbp - 0x1c]
cmp rdx, rcx
jne 0x1400f5d55
test eax, eax
je 0x1400f5d55
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rsi
mov edx, 0x259
xor ecx, ecx
lea r8d, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f5c56
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400fc010
test al, al
je 0x1400f5c56
lea r8d, [rsi + 1]
lea rdx, [0x140347c20]
lea rcx, [rbp - 0x28]
call fcn.1402019e0
test al, al
jne 0x1400f5c56
mov edx, dword [rbp - 0x1c]
lea rcx, [rbp - 0x18]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x18]
call fcn.1402bd21c
mov edx, dword [rbp - 0x1c]
lea rcx, [rbp - 0x18]
call fcn.140200570
mov eax, dword [0x14042c9e0]
test al, 1
jne 0x1400f5c8e
or eax, 1
mov dword [0x14042c9e0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x14042c9e8], rax
mov qword [0x14042c9f0], 0xffffffff80000002
lea rcx, [0x1403017d0]
call fcn.1402bb344
lea rdx, [0x14034ee50]
lea rcx, [0x14042c9e8]
call fcn.1400eb8d0
mov rbx, rax
test rax, rax
je 0x1400f5d45
lea rdx, [0x14034f1b0]
mov rcx, rax
call fcn.1400ebdd0
cmp eax, 4
je 0x1400f5d37
mov dword [rbp + 0x20], edi
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x14034f1b0]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400f5d37
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400f5d00
test rax, rax
je 0x1400f5d37
mov eax, dword [rbp - 0xc]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.RURL
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp dword [rbp - 0x10], 0
jle 0x1400f5d55
mov rcx, qword [rbp - 0x18]
call fcn.1402b9c20
nop
cmp dword [rbp - 0x20], 0
jle 0x1400f5d64
mov rcx, qword [rbp - 0x28]
call fcn.1402b9c20
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400f66b0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x100], 1
mov rdi, rcx
jne 0x1400f66cb
cmp byte [rcx + 0x104], 0
je 0x1400f66e6
call fcn.140179480
test al, al
jne 0x1400f66e6
mov rcx, rdi
call fcn.1400f8c10
test al, al
jne 0x1400f66e6
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400f6730]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
test rax, rax
mov qword [rdi + 0x280], rax
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x1400f8af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ecx, ecx
xor ebp, ebp
call fcn.1400f2f90
mov rsi, rax
test rax, rax
je 0x1400f8b6f
mov rcx, qword [rsi + 8]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.NoRestorePoint
xor r8d, r8d
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
test ebx, ebx
cmove ebp, dword [rsp + 0x58]
mov edx, 1
mov rcx, rsi
call qword [rax]
test ebp, ebp
jne 0x1400f8bef
mov rax, qword [rdi + 0x498]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400f8bef
nop
mov rcx, qword [rbx + 0x30]
test byte [rcx + 0x40], 1
je 0x1400f8b95
mov rax, qword [rcx]
call qword [rax + 0x48]
cmp eax, 7
jne 0x1400f8bfe
cmp byte [rbx + 0x19], 0
jne 0x1400f8be6
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400f8bbf
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400f8be6
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400f8bb1
jmp 0x1400f8be6
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400f8be3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1400f8be3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400f8bd0
mov rbx, rax
cmp rbx, qword [rdi + 0x498]
jne 0x1400f8b80
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f9090
Capabilities:
Get disk information

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x1398]
mov eax, 0x1498
call fcn.1402cb740
sub rsp, rax
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x1380], rax
cmp qword [rcx + 0x3f0], 0
mov r14, rcx
ja 0x1400f928f
mov eax, dword [0x14034f590]
lea rdx, [rbp + 0x380]
mov ecx, 0x3ff
mov dword [rsp + 0x70], eax
movzx eax, word [0x14034f594]
mov word [rsp + 0x74], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [rbp + 0x380], 0
je 0x1400f928f
mov qword [rsp + 0x14b8], rbx
mov qword [rsp + 0x1490], rdi
lea rdi, [rbp + 0x380]
mov qword [rsp + 0x14c0], rsi
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi]
lea rdx, [rbp + 0xb80]
lea rcx, [rsp + 0x70]
mov r8d, 0x400
mov word [rsp + 0x70], ax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1400f9250
lea r8, [rbp + 0xb80]
lea rdx, [rsp + 0x70]
lea rcx, str._ws___ws_r_n
call fcn.1402ba358
lea rcx, [rbp + 0xb80]
mov edx, 0x3b
call fcn.1402bcdb4
test rax, rax
je 0x1400f9204
mov edx, 0x3a
mov rcx, rax
call fcn.1402bcdb4
test rax, rax
je 0x1400f9250
mov edx, 0x5c
mov rcx, rax
call fcn.1402bcdb4
mov rsi, rax
test rax, rax
je 0x1400f9250
lea r8, [0x140347f58]
lea rcx, [rbp - 0x80]
mov edx, 0x200
call fcn.1402b96f8
lea rcx, [rbp - 0x80]
mov r8, rsi
mov edx, 0x200
call fcn.1402bbbd8
lea rax, [rbp - 0x80]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movzx eax, word [rdi]
lea rcx, [r14 + 0x3e8]
mov word [rsp + 0x48], ax
call fcn.14011c5a0
lea rdx, [rsp + 0x50]
jmp 0x1400f922e
lea rax, [rbp + 0xb80]
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 0x3e8]
mov qword [rsp + 0x30], rax
movzx eax, word [rdi]
mov word [rsp + 0x38], ax
call fcn.14011c5a0
lea rdx, [rsp + 0x60]
lea r9, [rax + 0x20]
lea rcx, [r14 + 0x3e8]
mov qword [rsp + 0x20], rax
call fcn.14011c610
nop dword [rax]
nop word [rax + rax]
inc rbx
cmp word [rbp + rbx*2 + 0x380], 0
jne 0x1400f9250
inc rbx
lea rdi, [rbp + 0x380]
cmp word [rdi + rbx*2], 0
lea rdi, [rdi + rbx*2]
jne 0x1400f9130
mov rdi, qword [rsp + 0x1490]
mov rsi, qword [rsp + 0x14c0]
mov rbx, qword [rsp + 0x14b8]
mov al, 1
mov rcx, qword [rbp + 0x1380]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0x1498
pop r14
pop rbp
ret
Function at 0x1400fb0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x38
mov rbp, rcx
xor ecx, ecx
mov dil, 1
call fcn.1400f2f90
xor esi, esi
mov r14, rax
test rax, rax
je 0x1400fb17b
mov rcx, qword [r14 + 8]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, str.NoRemnantScan
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
jne 0x1400fb15d
cmp dword [rsp + 0x68], esi
movzx edi, dil
cmovne edi, esi
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
test dil, dil
jne 0x1400fb17b
xor al, al
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp byte [rbp + 0x23], sil
sete al
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400fc010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rsi
mov rbx, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400fc147
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, word [0x14041c49c]
cmp cx, word [rax]
jne 0x1400fc0d4
lea rcx, vtable.Core::Text::UnicodeEncoding.0
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.14020bb20
mov rbx, rax
mov edx, dword [rax + 0xc]
mov rcx, rsi
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsi + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsi]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
mov rcx, rsi
call fcn.140200570
nop
cmp dword [rsp + 0x40], 0
jle 0x1400fc0d2
mov rcx, qword [rsp + 0x38]
call fcn.1402b9c20
nop
jmp 0x1400fc13c
lea rcx, vtable.Core::Text::ASCIIEncoding.0
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.1402043c0
mov rbx, rax
mov edx, dword [rax + 0xc]
mov rcx, rsi
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsi + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsi]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
mov rcx, rsi
call fcn.140200570
nop
cmp dword [rsp + 0x40], 0
jle 0x1400fc13c
mov rcx, qword [rsp + 0x38]
call fcn.1402b9c20
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400fc1d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov rsi, rcx
mov edx, 0x136
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400fc2a0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400fc29e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov r14d, edi
shr rdi, 5
mov ecx, 0x40
call fcn.1402b968c
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400fc25f
mov rdx, rdi
mov rcx, rax
call fcn.14011a370
nop
mov qword [rsi + 0x4e0], rax
lea rdi, [r14 + rbx]
cmp rbx, rdi
jae 0x1400fc295
nop
movzx r9d, byte [0x14042c16b]
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, qword [rsi + 0x4e0]
call fcn.14011c180
add rbx, 0x20
cmp rbx, rdi
jb 0x1400fc270
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1400fd4f0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x270], 0
mov rdi, rcx
je 0x1400fd50b
mov al, 1
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
mov r9, rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1400fd550]
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
test rax, rax
mov qword [rdi + 0x270], rax
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x1400ff5a0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebp, 1
xor edx, edx
xor ecx, ecx
mov r8d, ebp
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400ff62f
lea r8d, [rbp + 3]
lea rdx, str.hitmanpro37
mov rcx, rax
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400ff621
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400ff618
cmp dword [rsp + 0x24], 4
movzx ebx, bl
cmove ebx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x60]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret