joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020f80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov r12, r9
mov rsi, r8
mov r15, rdx
mov rdi, rcx
cmp r8, rbx
jne 0x140020fc8
lea rdx, str.RegistryEx.cpp
lea rcx, str.pszValue___pszDefaultValue
mov r8d, 0x126
call fcn.1400015d0
xor ebp, ebp
mov r13d, ebp
test r15, r15
je 0x140021160
test rsi, rsi
je 0x140021160
test r12, r12
je 0x140021160
mov rcx, qword [rdi + 0x10]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x60], r14
test rcx, rcx
je 0x140021115
mov r14, qword [rsp + 0x88]
mov r13d, dword [r12]
mov qword [rsp + 0x68], rcx
test r14, r14
je 0x14002103d
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140021115
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
test r14, r14
je 0x14002106e
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x80]
cmp ecx, 2
jne 0x1400210e0
mov eax, 2
mul r13
cmovo rax, rdi
mov rcx, rax
call fcn.1400222cc
mov r14, rax
test rax, rax
je 0x1400210d9
mov r8d, r13d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, rsi
mov rcx, r14
sub rdx, r14
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1400210b0
mov rax, rdi
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400210c4
mov rcx, r14
mov dword [r12], eax
call fcn.140022bc8
mov ecx, dword [rsp + 0x80]
test r15d, r15d
jne 0x140021115
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x1400210f2
cmp ecx, 7
jne 0x1400210f7
mov ebp, 1
mov eax, ebp
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
test rbx, rbx
je 0x14002115c
nop word [rax + rax]
cmp word [rbx + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x140021120
lea ecx, [rdi*2 + 2]
cmp ecx, r13d
ja 0x14002115c
sub rsi, rbx
nop word [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rsi + rbx - 2], ax
test ax, ax
jne 0x140021140
mov dword [r12], ecx
mov eax, 1
jmp 0x1400210f9
xor eax, eax
jmp 0x1400210f9
xor eax, eax
jmp 0x1400210fe
Function at 0x1400213f0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push r14
sub rsp, 0x60
mov rcx, qword [rcx + 0x10]
mov rsi, r9
mov r14d, r8d
mov rbp, rdx
test rcx, rcx
je 0x1400214d3
test rdx, rdx
je 0x1400214d3
test r9, r9
je 0x1400214d3
mov qword [r11 + 0x10], rbx
xor ebx, ebx
mov qword [r11 - 0x18], rcx
cmp qword [rsp + 0x98], rbx
je 0x140021494
mov rdx, qword [rsp + 0x98]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14002148f
xor eax, eax
mov rbx, qword [rsp + 0x78]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x90]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp qword [rsp + 0x98], rbx
je 0x1400214ca
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x140021477
lea r11, [rsp + 0x60]
xor eax, eax
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x140023ec4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140023eda
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140023edc
xor eax, eax
test eax, eax
je 0x140023eec
mov ecx, eax
call fcn.140024df0
or eax, 0xffffffff
jmp 0x140023eee
xor eax, eax
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
push r9
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1400014c0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WerSetFlags]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.1400016fc
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140001a74
mov ebx, dword [rsp + 0x20]
mov rdi, rax
sub ebx, 1
je 0x140003470
cmp ebx, 1
je 0x140003457
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
lea rdx, [rdi + 8]
mov ecx, ebx
call fcn.140001e50
test al, al
je 0x140003481
mov eax, dword [rsp + 0x20]
jmp 0x14000153c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax + 8]
lea rdx, str._private
call qword [sym.imp.MSVCR120_CLR0400.dll__wcsicmp]
test eax, eax
jne 0x140001518
test ebx, ebx
setg cl
call fcn.140005eec
nop
jmp 0x140001518
lea rdx, [rdi + 8]
mov ecx, ebx
call fcn.140004c6c
nop
jmp 0x14000153c

Function at 0x1400017c0
Capabilities:
Hash data using djb2
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
or rbp, 0xffffffffffffffff
mov rbx, rcx
mov r8, rbp
xor esi, esi
inc r8
cmp word [rcx + r8*2], si
jne 0x1400017f5
mov eax, edx
neg eax
mov eax, 0x3f
sbb ecx, ecx
and ecx, 8
sub eax, ecx
cdqe
cmp r8, rax
ja 0x140001873
mov edi, 0x40
test edx, edx
je 0x14000368d
cmp dword [0x14001b1b8], esi
jne 0x14000363d
lea r8, str.COMPlus_
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120_CLR0400.dll_wcscpy_s]
jmp 0x140001847
mov r8, rbx
lea rcx, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.MSVCR120_CLR0400.dll_wcscat_s]
xor r8d, r8d
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rdi, eax
test eax, eax
jne 0x14000248c
xor eax, eax
jmp 0x140001878
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140001460
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov eax, 2
mul rdi
cmovo rax, rbp
mov rcx, rax
call fcn.140001cd0
mov rbx, rax
test rax, rax
je 0x1400024b9
mov r8d, edi
lea rcx, [rsp + 0x20]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, rbx
jmp 0x140001878
movzx ecx, word [rbx]
mov r8, rbx
mov edx, 0x1505
jmp 0x140003662
lea eax, [rcx - 0x61]
cmp eax, 0x19
ja 0x140003655
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add r8, 2
movzx ecx, word [r8]
test ecx, ecx
jne 0x14000364a
movzx ecx, dl
mov eax, ecx
mov edx, ecx
shr rax, 5
lea rcx, [0x14001b1c0]
and edx, 0x1f
mov eax, dword [rcx + rax*4]
bt eax, edx
jb 0x14000182f
jmp 0x140001873
mov word [rsp + 0x20], si
jmp 0x140001847
Function at 0x140001d0c
Capabilities:
Terminate process

Disassembly:
movzx r9d, si
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400014c0
mov dword [0x14001b038], eax
cmp dword [0x14001b020], 0
jne 0x140003b4a
mov ecx, eax
call qword [sym.imp.MSVCR120_CLR0400.dll_exit]
nop
jmp 0x140003b4a
sub rsp, 0x28
call fcn.140001980
add rsp, 0x28
jmp 0x140001d20
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [rax - 0x10], 0
and dword [rax - 0x18], 0
call qword [sym.imp.MSVCR120_CLR0400.dll___crtGetShowWindowMode]
movzx esi, ax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 8]
xor ebx, ebx
xor eax, eax
lock cmpxchg qword [0x14001b218], rdx
jne 0x140003ae0
mov eax, dword [0x14001b220]
cmp eax, 1
je 0x140003af5
mov eax, dword [0x14001b220]
test eax, eax
jne 0x140003b0d
mov dword [0x14001b220], 1
lea rdx, [0x140011560]
lea rcx, [0x140011540]
call fcn.14013a000
test eax, eax
jne 0x140003b03
mov eax, dword [0x14001b220]
cmp eax, 1
jne 0x140001dcc
lea rdx, [0x140011538]
lea rcx, [0x1400114f0]
call sub.MSVCR120_CLR0400.dll__initterm
mov dword [0x14001b220], 2
test ebx, ebx
jne 0x140001dd9
xor eax, eax
xchg qword [0x14001b218], rax
cmp qword [0x14001b238], 0
jne 0x140003b1d
mov rax, qword [sym.imp.MSVCR120_CLR0400.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
cmp byte [rbx], 0x20
jbe 0x140001e24
cmp byte [rbx], 0x22
je 0x140003b62
movzx ecx, byte [rbx]
call qword [sym.imp.MSVCR120_CLR0400.dll__ismbblead]
test eax, eax
jne 0x140003b75
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140001dfa
cmp byte [rbx], 0
je 0x140001e2d
test edi, edi
jne 0x140001dff
mov al, byte [rbx]
dec al
cmp al, 0x1f
ja 0x14000147e
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140001e2d
cmp rax, rdx
jne 0x140003aef
mov ebx, 1
jmp 0x140001d62
jmp 0x140001d51
lea ecx, [rax + 0x1e]
call sub.MSVCR120_CLR0400.dll__amsg_exit
jmp 0x140001da4
mov eax, 0xff
jmp 0x140003bb0
mov dword [0x14001b37c], 1
jmp 0x140001da4
lea rcx, [0x14001b238]
call fcn.14000db00
test eax, eax
je 0x140001de7
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14001b238]
call rax
nop
jmp 0x140001de7
cmp dword [0x14001b37c], 0
jne 0x140003b5f
call qword [sym.imp.MSVCR120_CLR0400.dll__cexit]
mov eax, dword [0x14001b038]
jmp 0x140003bb0
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
jmp 0x140001e08
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140001e19
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400020b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], r9d
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x28], 0
mov rbx, r8
and dword [rbp + 0x48], 0
mov r14, rdx
mov esi, dword [rbp + 0x50]
mov r12, rcx
mov dword [rbp - 0x30], 4
test sil, 1
je 0x140002109
mov edx, dword [rbp + 0x58]
call fcn.1400017c0
mov rdi, rax
test rax, rax
jne 0x140003698
test sil, 0xe
je 0x1400021fb
mov rcx, r12
call fcn.140002224
test eax, eax
je 0x1400021fb
mov r13d, 0x20019
test sil, 2
je 0x140002176
mov rcx, qword [0x14001b0c8]
xor edi, edi
mov qword [rbp - 0x20], rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400036f3
lea rax, [rbp - 0x20]
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoft.NETFramework
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 1
test eax, eax
je 0x1400036ef
test sil, 4
je 0x1400021fb
mov rcx, qword [0x14001b0d0]
xor edi, edi
mov qword [rbp - 0x18], rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400021bf
lea rax, [rbp - 0x18]
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoft.NETFramework
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 1
test eax, eax
jne 0x1400021fb
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x48]
lea rax, [rbp - 0x28]
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rsi, eax
test edi, edi
je 0x1400021f2
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x140003743
mov qword [rbx], r14
mov eax, 0x80004005
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.MSVCR120_CLR0400.dll__errno]
mov r8d, 0x10
lea rdx, [rbp - 0x10]
mov rcx, rdi
and dword [rax], 0
call qword [sym.imp.MSVCR120_CLR0400.dll_wcstoul]
mov r13d, eax
call qword [sym.imp.MSVCR120_CLR0400.dll__errno]
cmp dword [rax], 0x22
je 0x1400036d0
cmp qword [rbp - 0x10], rdi
je 0x1400036d0
mov r15d, 1
jmp 0x1400036d3
xor r15d, r15d
mov rcx, rdi
call fcn.1400010a0
test r15d, r15d
je 0x140002109
mov qword [rbx], r13
xor eax, eax
jmp 0x140002203
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x48]
lea rax, [rbp - 0x28]
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r15, eax
test edi, edi
je 0x140003726
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
jne 0x140002176
cmp dword [rbp + 0x48], 4
jne 0x140002176
mov rax, qword [rbp - 0x28]
mov qword [rbx], rax
jmp 0x1400036e7
cmp dword [rbp + 0x48], 4
jne 0x1400021fb
jmp 0x140003739
Function at 0x140002224
Capabilities:
Hash data using djb2

Disassembly:
xor r8d, r8d
mov rdx, rcx
cmp dword [0x14001b1bc], r8d
jne 0x1400039ca
mov r8d, 1
mov eax, r8d
ret
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r8w
jne 0x1400039ce
cmp rax, 0x50
ja 0x140002237
movzx ecx, word [rcx]
mov r9d, 0x1505
jmp 0x140003a06
lea eax, [rcx - 0x61]
cmp eax, 0x19
ja 0x1400039f8
and ecx, 0xffffffdf
imul r9d, r9d, 0x21
xor r9d, ecx
add rdx, 2
movzx ecx, word [rdx]
test ecx, ecx
jne 0x1400039ed
movzx ecx, r9b
mov eax, ecx
mov edx, ecx
shr rax, 5
lea rcx, [0x14001b1e0]
and edx, 0x1f
mov eax, dword [rcx + rax*4]
bt eax, edx
jb 0x140002237
jmp 0x14000223d
Function at 0x140003d00
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
mov eax, 0x2048
call fcn.140002cb0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2030], rax
lea rax, [rsp + 0x2058]
mov r9, rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
or r8, 0xffffffffffffffff
mov edx, 0x1000
call qword [sym.imp.MSVCR120_CLR0400.dll__vsnwprintf_s]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140003d6d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140003d99
call qword [sym.imp.MSVCR120_CLR0400.dll___iob_func]
lea r8, [rsp + 0x30]
lea rdx, [0x140011bd8]
lea rcx, [rax + 0x30]
call qword [sym.imp.MSVCR120_CLR0400.dll_fwprintf]
call qword [sym.imp.MSVCR120_CLR0400.dll___iob_func]
lea rcx, [rax + 0x30]
call qword [sym.imp.MSVCR120_CLR0400.dll_fflush]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140001460
add rsp, 0x2048
ret

Function at 0x140004e84
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
lea rbp, [rax - 0x178]
sub rsp, 0x268
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor ebx, ebx
cmp byte [0x14001c17c], bl
jne 0x140004ee6
lea rcx, str.NGenServiceDebugLog
call fcn.140001fc4
mov dword [0x14001c178], eax
mov byte [0x14001c17c], 1
jmp 0x140004eec
mov eax, dword [0x14001c178]
test eax, eax
je 0x140004f5c
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x34], 0x200
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 2
mov rax, qword [rsp + 0x40]
mov word [rax], bx
lea r8, [rbp + 0x188]
mov rdx, qword [rbp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14000a294
lea rcx, [rsp + 0x30]
call fcn.1400096f0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
test byte [rsp + 0x38], 8
je 0x140004f5c
mov rcx, qword [rsp + 0x40]
call fcn.1400010a0
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140001460
add rsp, 0x268
pop rbx
pop rbp
ret
Function at 0x140005a54
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
call fcn.140004f78
and qword [rsp + 0x30], 0
lea rcx, str.Calling_StartServiceCtrlDispatcher_n
and qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
lea rax, [0x1400059a4]
mov qword [rsp + 0x28], rax
call fcn.140004e84
mov rax, qword [0x14001b920]
test rax, rax
jne 0x140005ae1
cmp byte [0x14001b90f], al
jne 0x140005add
xor r8d, r8d
lea rcx, str.advapi32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x140005aca
lea rdx, str.StartServiceCtrlDispatcherW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001b920], rax
jmp 0x140005ad1
mov rax, qword [0x14001b920]
mov byte [0x14001b90f], 1
test rax, rax
jne 0x140005ae1
xor eax, eax
jmp 0x140005ae8
lea rcx, [rsp + 0x20]
call rax
test eax, eax
jne 0x140005b02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartServiceCtrlDispatcher_failed_with_error__d.__Will_try_slow_path_n
call fcn.140004e84
jmp 0x140005b1f
lea rcx, str.StartServiceCtrlDispatcher_done__exiting_n
call fcn.140004e84
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x48
ret

Function at 0x140005b24
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x44], 0x200
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x50]
mov word [rax], bx
lea rcx, [rsp + 0x40]
call fcn.1400043c0
lea rdx, str._ndpsetup.bat
lea rcx, [rsp + 0x40]
call fcn.1400040a8
lea rcx, [rsp + 0x40]
call fcn.1400096f0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005be1
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
lea r8, str.Install
lea rdx, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
call fcn.14000b900
test eax, eax
je 0x140005bdf
cmp dword [rsp + 0x30], 1
je 0x140005be1
mov bl, 1
test byte [rsp + 0x48], 8
je 0x140005bf2
mov rcx, qword [rsp + 0x50]
call fcn.1400010a0
mov al, bl
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140001460
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rbp
ret
Function at 0x14000b900
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
mov rbx, r9
mov rdi, r8
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x18]
mov qword [r11 - 0x38], rax
mov r9d, 0x20019
call fcn.140007098
test eax, eax
jne 0x14000b991
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x10], 4
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b991
cmp dword [rbp + 0x30], 4
jne 0x14000b991
cmp dword [rbp + 0x10], 4
jne 0x14000b991
mov eax, dword [rbp - 0x20]
mov dword [rbx], eax
mov ebx, 1
jmp 0x14000b993
xor ebx, ebx
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14000b9a2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x1400094b0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14002b033
cmp dword [rcx], 0x6060
jne 0x14002b033
mov rax, qword [0x1400c02d8]
cmp qword [rcx + 8], rax
jne 0x14002afaa
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax + 0x2b0]
call qword [case.0x140007f48.0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x14002b029
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
or qword [rbx + 0x38], 0xffffffffffffffff
cmp qword [rbx + 0x40], 0
je 0x14002b029
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rcx, qword [rbx + 0x40]
mov rdi, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14002affe
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
test rdi, rdi
je 0x14002b00b
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400c02b8]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
and qword [rbx + 0x40], 0
mov eax, 1
jmp 0x1400094fe
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x1400094fe