joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008eb08
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rcx, rsi
je 0x10008eb5a
test byte [rcx + 0x1c], 1
je 0x10008eb5a
cmp byte [rcx + 0x19], 5
jb 0x10008eb5a
mov eax, dword [rdi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001e390]
mov edx, 0x2c
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.100058720
mov rcx, qword [rbx]
and dword [rsp + 0x60], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x30]
lea rdx, [0x100022f38]
xor r8d, r8d
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x10008eba7
mov eax, dword [rsp + 0x30]
sub eax, 4
neg eax
sbb ebx, ebx
and ebx, 0xd
mov r10, qword [0x100153eb8]
cmp r10, rsi
je 0x10008ebe8
test byte [r10 + 0x1c], 2
je 0x10008ebe8
cmp byte [r10 + 0x19], 5
jb 0x10008ebe8
mov eax, dword [rsp + 0x60]
mov rcx, qword [r10 + 0x10]
lea r8, [0x10001e390]
mov edx, 0x2d
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.10003be4c
mov r10, qword [0x100153eb8]
test ebx, ebx
jne 0x10008ec2a
cmp r10, rsi
je 0x10008ec1d
test byte [r10 + 0x1c], 2
je 0x10008ec1d
cmp byte [r10 + 0x19], 4
jb 0x10008ec1d
mov eax, dword [rsp + 0x60]
mov r9d, dword [rdi]
mov rcx, qword [r10 + 0x10]
lea edx, [rbx + 0x2e]
lea r8, [0x10001e390]
mov dword [rsp + 0x20], eax
call fcn.10003be4c
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
mov r10, qword [0x100153eb8]
cmp r10, rsi
je 0x10008ec69
test byte [r10 + 0x1c], 1
je 0x10008ec69
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x10008ec69
mov ecx, dword [rdi]
lea r8, [0x10001e390]
mov edx, 0x2f
mov dword [rsp + 0x20], ecx
mov rcx, qword [r10 + 0x10]
mov r9d, ebx
call fcn.10003be4c
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1000dbbac
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
xor esi, esi
mov r12, r9
mov r13, r8
mov r14, rdx
mov rbp, rcx
lea rdi, [0x100153eb8]
test rcx, rcx
je 0x1000dbd93
test rdx, rdx
je 0x1000dbd93
test r8, r8
je 0x1000dbd93
test r9, r9
je 0x1000dbd93
and dword [rax - 0x58], esi
lea r8d, [rsi + 0x28]
lea rcx, [rax - 0x50]
xor edx, edx
call sub.msvcrt.dll_memset
and qword [rsp + 0x30], rsi
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 0x800
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
mov ebx, eax
bts ebx, 0x1c
test ebx, ebx
js 0x1000dbd23
lea rcx, [rsp + 0x40]
mov rdx, rbp
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0xb0]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x40]
lea r8d, [rsi + 1]
mov edx, 0x80000000
mov qword [rsp + 0x20], rax
call sub.ADVAPI32.dll_LsaLookupNames2
mov ebx, eax
bts ebx, 0x1c
test ebx, ebx
js 0x1000dbd15
mov rcx, qword [rsp + 0xb0]
cmp dword [rcx], 7
je 0x1000dbcf9
cmp dword [rcx], 8
je 0x1000dbcf9
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1000dbcf2
mov r8, qword [rsp + 0xb0]
mov rdx, rax
mov ecx, ebx
mov r8, qword [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1000dbcd8
mov rsi, rdi
xor edi, edi
xor ebx, ebx
jmp 0x1000dbce0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdi, [0x100153eb8]
jmp 0x1000dbcfe
mov ebx, 0x8007000e
jmp 0x1000dbce9
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0xb0]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x30]
call sub.ADVAPI32.dll_LsaClose
test ebx, ebx
jns 0x1000dbd59
mov rcx, qword [0x100153eb8]
cmp rcx, rdi
je 0x1000dbd9f
test byte [rcx + 0x1c], 2
je 0x1000dbd9f
cmp byte [rcx + 0x19], 2
jb 0x1000dbd9f
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc98]
mov r9, rbp
call fcn.10003b678
jmp 0x1000dbd98
mov r9, r12
mov r8, rsi
mov rdx, r13
mov rcx, r14
call fcn.1000dbe0c
mov ebx, eax
test eax, eax
jns 0x1000dbd98
mov rcx, qword [0x100153eb8]
cmp rcx, rdi
je 0x1000dbd9f
test byte [rcx + 0x1c], 2
je 0x1000dbd9f
cmp byte [rcx + 0x19], 2
jb 0x1000dbd9f
mov edx, 0x32
mov dword [rsp + 0x20], eax
jmp 0x1000dbd44
mov ebx, 0x80004003
mov rcx, qword [0x100153eb8]
test rsi, rsi
je 0x1000dbdb4
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x100153eb8]
test ebx, ebx
jns 0x1000dbde5
cmp rcx, rdi
je 0x1000dbde5
test byte [rcx + 0x1c], 2
je 0x1000dbde5
cmp byte [rcx + 0x19], 2
jb 0x1000dbde5
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc98]
mov edx, 0x33
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10003b678
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000df9f8
Capabilities:
Get routing table

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rdx
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
mov eax, 5
cmp rcx, rdx
je 0x1000dfa4a
test byte [rcx + 0x1c], 1
je 0x1000dfa4a
cmp byte [rcx + 0x19], al
jb 0x1000dfa4a
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x3c]
lea r8, [0x10001dc88]
mov r9, r14
call fcn.100034834
xor esi, esi
or eax, 0xffffffff
xor edi, edi
and dword [rsp + 0x58], esi
mov qword [rsp + 0x60], rdi
mov r12d, eax
mov ebp, eax
lea r13d, [rsi + 2]
test r14, r14
jne 0x1000dfa72
mov ebx, 0x80004003
jmp 0x1000dfb52
mov ecx, 0x3c
call fcn.10011bdc8
mov rsi, rax
test rax, rax
jne 0x1000dfa8e
mov ebx, 0x8007000e
jmp 0x1000dfb52
lea rdx, [rsp + 0x58]
xor r8d, r8d
mov rcx, rax
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x1000dfad0
mov rcx, rsi
call sub.msvcrt.dll_free
mov ecx, dword [rsp + 0x58]
call fcn.10011bdc8
mov rsi, rax
test rax, rax
je 0x1000dfa84
lea rdx, [rsp + 0x58]
xor r8d, r8d
mov rcx, rax
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
je 0x1000dfae2
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1000dfb52
cmp dword [rsi], edi
jbe 0x1000dfb0b
mov ecx, dword [rsi]
lea rax, [rsi + 8]
cmp dword [rax - 4], edi
jne 0x1000dfb01
cmp dword [rax], edi
jne 0x1000dfb01
cmp dword [rax + 0x20], ebp
jae 0x1000dfb01
mov r12d, dword [rax + 0xc]
mov ebp, dword [rax + 0x20]
add rax, 0x38
sub rcx, 1
jne 0x1000dfaec
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov ecx, r13d
call fcn.1000e75e0
mov rdi, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
js 0x1000dfb52
mov rdx, rdi
test rdi, rdi
je 0x1000dfb4d
cmp dword [rdx + 4], r12d
je 0x1000dfbc0
cmp r12d, 0xffffffff
jne 0x1000dfb44
cmp dword [rdx + 0x68], 1
je 0x1000dfbc0
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x1000dfb2e
mov ebx, 0x80004005
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000dfba7
test byte [rcx + 0x1c], 1
je 0x1000dfba7
movzx eax, byte [rcx + 0x19]
test ebx, ebx
mov edx, 5
cmovns r13d, edx
cmp eax, r13d
jl 0x1000dfba7
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc88]
mov edx, 0x42
mov r9d, ebx
call fcn.100036510
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rdx, qword [rdx + 0x18]
test rdx, rdx
je 0x1000dfb4d
cmp qword [rdx + 0x10], 0
je 0x1000dfbdf
cmp dword [rdx + 0x18], 0
jle 0x1000dfbdf
cmp dword [rdx + 0x18], 0x80
jbe 0x1000dfbe5
mov rdx, qword [rdx + 8]
jmp 0x1000dfbc4
movsxd r8, dword [rdx + 0x18]
mov rdx, qword [rdx + 0x10]
mov rcx, r14
call sub.msvcrt.dll_memcpy
jmp 0x1000dfb52
Function at 0x1000e0a10
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov esi, edx
mov r12, rcx
mov qword [rsp + 0x38], rcx
lea r14, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000e0a93
test byte [rcx + 0x1c], 1
je 0x1000e0a8b
mov r13d, 5
cmp byte [rcx + 0x19], r13b
jb 0x1000e0a99
lea edx, [r13 + 0xa]
mov r9d, esi
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1000e0a99
mov r13d, 5
jmp 0x1000e0a99
mov r13d, 5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [r12 + 0x80], esi
and dword [r12 + 0x84], 0
cmp qword [r12 + 0x78], 0
je 0x1000e0c18
cmp qword [r12 + 0x38], 0
jne 0x1000e0acb
xor eax, eax
jmp 0x1000e0af9
xor eax, eax
cmp dword [r12 + 0x40], eax
jbe 0x1000e0af7
mov rdx, qword [r12 + 0x30]
mov rcx, rdx
cmp qword [rcx], 0
jne 0x1000e0af1
inc eax
add rcx, 8
cmp eax, dword [r12 + 0x40]
jb 0x1000e0adc
jmp 0x1000e0af7
mov rax, qword [rdx + rax*8]
jmp 0x1000e0af9
xor eax, eax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1000e0b20
lea rdx, [rsp + 0x30]
lea rcx, [r12 + 0x30]
call fcn.10004d4b0
mov rcx, qword [rax]
and dword [rcx], 0
cmp qword [rsp + 0x30], 0
jne 0x1000e0b03
lea rcx, [0x100001eb0]
cmp qword [r12 + 0x78], 0
cmovne rcx, qword [r12 + 0x78]
mov r8d, 0x40
lea rdx, [rsp + 0x50]
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
jne 0x1000e0b62
mov ecx, 0x8007000e
call fcn.100036284
int3
mov edx, 0x10000
mov r8d, 1
mov rcx, rax
call fcn.1000f24c8
mov qword [r12 + 0x28], rax
test rax, rax
je 0x1000e0be0
mov rcx, rax
call fcn.1000f2e94
test eax, eax
je 0x1000e0bca
mov edx, esi
mov rcx, r12
call fcn.1000e04f8
mov esi, eax
test eax, eax
js 0x1000e0bf4
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1000e07c4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1000e0bf4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000e0bf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1000e0bf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
jmp 0x1000e0c1d
mov esi, 0x80004005
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000e0c5a
test byte [rcx + 0x1c], 1
je 0x1000e0c5a
movzx edx, byte [rcx + 0x19]
mov eax, 2
test esi, esi
cmovns eax, r13d
cmp edx, eax
jl 0x1000e0c5a
mov edx, 0x10
mov r9d, esi
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.10011be80
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1000e0c98
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, rcx
lea rsi, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e0cfc
test byte [rcx + 0x1c], 1
je 0x1000e0cfc
mov edx, 0x11
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100034784
lea rcx, [0x100152100]
mov rax, qword [0x100152100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
xor edi, edi
cmp qword [r12 + 0x28], rdi
je 0x1000e0dfd
lea rdx, [rsp + 0x40]
mov ebx, 0x104
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000e0d3d
cmp eax, ebx
jb 0x1000e0d59
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x1000e0dfd
lea r9, [0x100026498]
lea r8, [rsp + 0x40]
lea rdx, [0x1000264c0]
lea rcx, [rsp + 0x20]
call fcn.100039dd4
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e0dac
mov ebx, 2
test byte [rcx + 0x1c], bl
je 0x1000e0db1
cmp byte [rcx + 0x19], 4
jb 0x1000e0db1
lea edx, [rbx + 0x10]
mov r9, qword [rsp + 0x20]
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.1000347a8
jmp 0x1000e0db1
mov ebx, 2
mov r9d, ebx
mov r8d, 0xa
mov rdx, qword [rsp + 0x20]
mov rcx, qword [r12 + 0x28]
call fcn.1000f2ad4
test eax, eax
jne 0x1000e0de3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1000e0de9
and qword [r12 + 0x28], 0
jmp 0x1000e0e02
mov ebx, 2
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e0e3f
test byte [rcx + 0x1c], 1
je 0x1000e0e3f
movzx eax, byte [rcx + 0x19]
mov edx, 5
test edi, edi
cmovns ebx, edx
cmp eax, ebx
jl 0x1000e0e3f
mov edx, 0x13
mov r9d, edi
lea r8, [0x10001dc68]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1000e0e60
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10011be80
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1000e2eb4
Capabilities:
Modify service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov dword [rax + 0x10], edx
push r13
sub rsp, 0x60
mov rdi, rcx
mov rcx, qword [0x100153eb8]
lea r12, [0x100153eb8]
lea r13, [0x10001dc48]
cmp rcx, r12
je 0x1000e2f2d
test byte [rcx + 0x1c], 1
je 0x1000e2f07
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r8, r13
call fcn.100034784
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000e2f2d
test byte [rcx + 0x1c], 2
je 0x1000e2f2d
cmp byte [rcx + 0x19], 4
jb 0x1000e2f2d
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
mov r8, r13
lea r9d, [rdx - 0x1a]
call fcn.100036510
mov edx, 1
mov rcx, rdi
call fcn.1000e3198
mov ebx, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000e2f68
test byte [rcx + 0x1c], 2
je 0x1000e2f68
cmp byte [rcx + 0x19], 4
jb 0x1000e2f68
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r9d, eax
mov r8, r13
call fcn.100036510
cmp ebx, 1
jne 0x1000e3027
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x78]
lea edx, [rbx + 2]
mov dword [rsp + 0x78], ebx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ebx, eax
cmp eax, 1
je 0x1000e2fb6
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000e3027
test byte [rcx + 0x1c], 2
je 0x1000e3027
cmp byte [rcx + 0x19], 2
jb 0x1000e3027
mov edx, 0x1d
jmp 0x1000e3018
mov rcx, qword [rdi + 0x10]
xor eax, eax
or edx, 0xffffffff
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8d, [rax + 2]
mov r9d, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp eax, 1
je 0x1000e3027
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000e3027
test byte [rcx + 0x1c], 2
je 0x1000e3027
cmp byte [rcx + 0x19], 4
jb 0x1000e3027
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.100036510
mov rcx, rdi
call fcn.1000e33d4
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000e305b
test byte [rcx + 0x1c], 1
je 0x1000e305b
cmp byte [rcx + 0x19], 5
jb 0x1000e305b
mov rcx, qword [rcx + 0x10]
mov edx, 0x1f
mov r9d, ebx
mov r8, r13
call fcn.100036510
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x1000e307c
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rcx, rsi
je 0x1000e30bc
test byte [rcx + 0x1c], 1
je 0x1000e30bc
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc48]
mov edx, 0x20
call fcn.100034784
xor edx, edx
mov rcx, rdi
call fcn.1000e3198
mov ebx, eax
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e30f8
test byte [rcx + 0x1c], 2
je 0x1000e30f8
cmp byte [rcx + 0x19], 4
jb 0x1000e30f8
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc48]
mov edx, 0x21
mov r9d, eax
call fcn.100036510
cmp ebx, 1
jne 0x1000e3148
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
cmp eax, 1
je 0x1000e3148
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e3148
test byte [rcx + 0x1c], 2
je 0x1000e3148
cmp byte [rcx + 0x19], 4
jb 0x1000e3148
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc48]
mov edx, 0x22
mov r9d, eax
call fcn.100036510
mov rcx, rdi
call fcn.1000e33d4
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000e3180
test byte [rcx + 0x1c], 1
je 0x1000e3180
cmp byte [rcx + 0x19], 5
jb 0x1000e3180
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc48]
mov edx, 0x23
mov r9d, ebx
call fcn.100036510
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000e5910
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rbp, r8
mov r12, rdx
mov r13, rcx
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000e5966
test byte [rcx + 0x1c], 1
je 0x1000e5966
cmp byte [rcx + 0x19], 5
jb 0x1000e5966
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4a
mov r9, r12
call fcn.1000347a8
mov rcx, qword [r13]
xor r14d, r14d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
mov esi, r14d
mov dword [rsp + 0x34], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r14d
jne 0x1000e59cb
cmp dword [rsp + 0x88], 1
je 0x1000e59be
cmp dword [rsp + 0x88], 2
je 0x1000e59be
lea ebx, [r14 + 0xd]
jmp 0x1000e59cb
mov esi, dword [rsp + 0x30]
mov ebx, r14d
shr esi, 1
mov dword [rsp + 0x34], esi
mov rdi, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rdi, rax
je 0x1000e5a09
test byte [rdi + 0x1c], 2
je 0x1000e5a09
cmp byte [rdi + 0x19], 4
jb 0x1000e5a09
mov rcx, qword [rdi + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4b
mov r9d, ebx
call fcn.100036510
mov rdi, qword [0x100153eb8]
cmp ebx, r14d
jne 0x1000e5b0d
mov rax, qword [rbp]
mov ecx, 1
lea edx, [rsi + 2]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or ecx, eax
jge 0x1000e5a32
mov rcx, rbp
call fcn.100036160
mov r8, qword [rbp]
lea r9, [rsp + 0x34]
mov rdx, r12
mov rcx, r13
call fcn.10004f4c0
mov ebx, eax
mov rcx, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rcx, rsi
je 0x1000e5a7f
test byte [rcx + 0x1c], 2
je 0x1000e5a7f
cmp byte [rcx + 0x19], 4
jb 0x1000e5a7f
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4c
mov r9d, eax
call fcn.100036510
mov eax, ebx
neg eax
sbb ecx, ecx
neg ecx
dec ecx
cmp ecx, 0xffffffff
jne 0x1000e5aab
mov rdi, qword [rbp]
cmp rdi, r14
jne 0x1000e5a9c
mov ecx, r14d
jmp 0x1000e5ab0
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, r14d
jl 0x1000e5b02
mov rax, qword [rbp]
cmp ecx, dword [rax - 0xc]
jg 0x1000e5b02
mov dword [rax - 0x10], ecx
mov rax, qword [rbp]
movsxd rcx, ecx
mov word [rax + rcx*2], r14w
mov rdi, qword [0x100153eb8]
cmp rdi, rsi
je 0x1000e5b4b
test byte [rdi + 0x1c], 2
je 0x1000e5b14
cmp byte [rdi + 0x19], 4
jb 0x1000e5b14
mov r9, qword [rbp]
mov rcx, qword [rdi + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4d
call fcn.1000347a8
mov rdi, qword [0x100153eb8]
jmp 0x1000e5b14
mov ecx, 0x80070057
call fcn.100036284
int3
lea rsi, [0x100153eb8]
cmp rdi, rsi
je 0x1000e5b4b
test byte [rdi + 0x1c], 1
je 0x1000e5b4b
movzx edx, byte [rdi + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1000e5b4b
mov rcx, qword [rdi + 0x10]
lea r8, [0x10001dc38]
mov edx, 0x4e
mov r9d, ebx
call fcn.100036510
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000e64d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x100152100]
lea rcx, [0x100152100]
xor edi, edi
call qword [rax + 0x18]
and qword [rsp + 0x68], rdi
lea rdx, [0x10001e7f0]
mov rbx, rax
lea rax, [rsp + 0x68]
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e6582
mov rsi, qword [rsp + 0x68]
and dword [rsp + 0x50], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
lea rdx, [0x100026570]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e6574
cmp dword [rsp + 0x60], 4
jne 0x1000e6574
test eax, eax
jne 0x1000e6574
cmp dword [rsp + 0x50], edi
lea eax, [rdi + 1]
cmovne edi, eax
test rsi, rsi
je 0x1000e6582
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbx
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1000e659d
mov rcx, qword [rbx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret