joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1600ca29c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x350
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov ebx, r8d
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], edx
mov rsi, rcx
mov edi, 1
test rcx, rcx
je 0x1600ca2eb
lea rdx, [0x1601d4934]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
jne 0x1600ca2ed
xor edi, edi
test edi, edi
je 0x1600ca497
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.160040aa8
nop
lea rcx, [rsp + 0x50]
call fcn.16005a594
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [0x1601f9c78]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
and qword [rsp + 0x38], 0
test ebx, ebx
je 0x1600ca352
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
imul rax, rbx, 0x989680
sub qword [rsp + 0x38], rax
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600ca463
lea rdx, [0x1601d5250]
lea rcx, [rsp + 0x11c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x1600ca44a
lea rdx, [0x1601f9cd8]
lea rcx, [rsp + 0x11c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x1600ca44a
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
lea rcx, [rsp + 0x50]
call fcn.16005a594
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [rsp + 0x11c]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
test byte [rsp + 0xf0], 0x10
je 0x1600ca421
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
call fcn.1600ca29c
jmp 0x1600ca44a
cmp dword [rsp + 0x34], 0
je 0x1600ca43f
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xfc]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CompareFileTime]
test eax, eax
jg 0x1600ca44a
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x1600ca36d
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600ca476
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
cmp dword [rsp + 0x30], 0
je 0x1600ca48c
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
neg eax
sbb ecx, ecx
and edi, ecx
lea rcx, [rsp + 0x50]
call fcn.160040b2c
nop
jmp 0x1600ca49d
mov eax, edi
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x350
pop rdi
pop rsi
pop rbx
ret
Function at 0x1600ca568
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x230
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [rsp + 0x20]
call fcn.1600ca5ec
test eax, eax
js 0x1600ca5c9
xor r9d, r9d
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1600ca5c7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1600ca5c9
movzx eax, ax
or eax, 0x80070000
jmp 0x1600ca5c9
xor eax, eax
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x258]
add rsp, 0x230
pop rdi
ret

Function at 0x1600ca688
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x238
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x220], rax
lea rdx, [rsp + 0x20]
call fcn.1600ca5ec
test eax, eax
jns 0x1600ca6b3
xor eax, eax
jmp 0x1600ca6be
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x238
ret

Function at 0x1600ca760
Capabilities:
Create directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
mov rdx, r8
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x1600ca7c2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbx], eax
cmp eax, 0x50
je 0x1600ca79d
cmp eax, 0xb7
je 0x1600ca79d
xor eax, eax
jmp 0x1600ca7e2
test rsi, rsi
je 0x1600ca7c2
mov r8, qword [rsi + 8]
mov edx, 4
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetFileSecurityW]
test eax, eax
jne 0x1600ca7c2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbx], eax
jmp 0x1600ca799
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
bts eax, 0xd
mov rcx, rdi
mov edx, eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
and dword [rbx], 0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1600ca834
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x2e8]
sub rsp, 0x3e0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov rbx, rcx
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.160040aa8
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x41
xor esi, esi
mov word [rsp + 0x58], si
lea rax, fcn.160040970
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x20]
call fcn.1600ca9d0
lea edx, [rax + 1]
lea rcx, [rbp - 0x20]
call fcn.160034aac
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x38], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1600ca936
mov rax, qword [rsp + 0x40]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, qword [rbp - 0x18]
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rsp + 0x40]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x54]
lea rdx, [rbp + 0xac]
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x1600ca8d4
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600ca94a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop
lea rcx, [rsp + 0x40]
call fcn.160040b2c
nop
lea rcx, [rbp - 0x20]
call fcn.160040b2c
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1600caab0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x268]
sub rsp, 0x350
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov qword [rsp + 0x30], rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
call fcn.160040ae8
nop
lea rcx, [rsp + 0x50]
call fcn.16005a594
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [0x1601f9c78]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
lea rdx, [rbp - 0x10]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600cac26
lea rdx, [0x1601d5250]
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x1600cac11
lea rdx, [0x1601f9cd8]
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x1600cac11
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
lea rcx, [rsp + 0x50]
call fcn.16005a594
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rsi]
mov r8d, dword [rbp - 0x10]
lea rdx, [rsp + 0x50]
mov rcx, rsi
test r8b, 0x10
je 0x1600cabfd
mov rax, qword [rax + 8]
call qword [case.0x16003fc5a.0]
mov edi, eax
test eax, eax
js 0x1600cac69
jne 0x1600cac0c
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1600caab0
jmp 0x1600cac06
mov rax, qword [rax]
call qword [case.0x16003fc5a.0]
test eax, eax
mov edi, eax
js 0x1600cac69
mov rdi, qword [rsp + 0x30]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x1600cab3d
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600cac39
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
xor edi, edi
lea rcx, [rsp + 0x50]
call fcn.160040b2c
mov eax, edi
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600cac3b
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
jmp 0x1600cac3b
Function at 0x1600cb8bc
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x50
and dword [rax + 0x20], 0
lea r8, [rax + 0x18]
xor edi, edi
mov r14, rdx
and dword [rax + 0x18], edi
mov rbp, rcx
and qword [rax - 0x38], rdi
mov rdx, rcx
lea r12d, [rdi + 1]
mov ecx, r12d
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoSizeExW]
mov esi, eax
test eax, eax
je 0x1600cb9b5
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8d, esi
lea edx, [rdi + 8]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1600cb9b5
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea ecx, [rdi + 3]
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoExW]
test eax, eax
je 0x1600cb99d
lea r9, [rsp + 0x98]
mov rcx, rbx
lea r8, [rsp + 0x40]
lea rdx, [0x1601d4914]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x1600cb99d
mov r8, qword [rsp + 0x40]
movzx ecx, word [r8 + 0xe]
movzx edx, word [r8 + 8]
movzx eax, word [r8 + 0xc]
movzx r9d, word [r8 + 0xa]
lea r8, str._d._d._d._d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov rcx, r14
mov dword [rsp + 0x20], edx
lea edx, [rdi + 0x15]
call fcn.160059e34
test eax, eax
cmovns edi, r12d
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
jne 0x1600cb9e3
and qword [rsp + 0x30], 0
lea r8, str._d._d._d._d
and qword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
mov rcx, r14
lea edx, [r9 + 0x15]
call fcn.160059e34
test eax, eax
cmovns edi, r12d
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1600cc944
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x180
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x50], VarUI4FromDisp
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
jne 0x1600cc9a5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1600cca11
movzx eax, ax
or eax, 0x80070000
jmp 0x1600cca11
cmp dword [rsp + 0x60], 2
jne 0x1600cc9ee
cmp dword [rsp + 0x54], 5
jb 0x1600cc9ee
mov rax, qword [rdi]
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, str.Global_
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rdi]
or r9d, 0xffffffff
mov r8d, dword [rdi + 0x14]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
jmp 0x1600cca09
mov rax, qword [rdi]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
nop
jmp 0x1600cca0f
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1600ccb2c
Capabilities:
Enumerate services
Query service status
Stop service

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r12
push rbp
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r9d, r9d
lea rax, [rbp - 0x15]
mov qword [r11 - 0x80], rax
mov r12, rcx
mov rcx, qword [rcx]
lea rax, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumDependentServicesW]
xor esi, esi
test eax, eax
jne 0x1600ccc99
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xea
jne 0x1600ccc99
mov ecx, dword [rbp - 0x19]
lea rdx, [0x1601d7c98]
call fcn.16006eafc
mov rbx, rax
test rax, rax
je 0x1600ccc91
mov r9d, dword [rbp - 0x19]
lea rax, [rbp - 0x15]
mov rcx, qword [r12]
lea edx, [rsi + 1]
mov qword [rsp + 0x28], rax
mov r8, rbx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumDependentServicesW]
test eax, eax
je 0x1600ccc91
mov r14d, esi
cmp dword [rbp - 0x15], esi
jbe 0x1600ccc91
mov eax, r14d
lea rcx, [rbp - 0x11]
mov r8d, 0x24
lea rdx, [rax + rax*2]
add rdx, rdx
mov rdx, qword [rbx + rdx*8]
call fcn.1600ccac0
cmp qword [rbp - 0x11], rsi
je 0x1600ccc7b
mov rcx, qword [rbp - 0x11]
lea r8, [rbp - 9]
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
lea edx, [rax + 1]
mov dword [rbp + 0xf], eax
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x1600ccc7b
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
lea r15, [rax + 0x7530]
cmp dword [rbp - 5], 1
je 0x1600ccc7b
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
cmp rax, r15
jae 0x1600ccc7b
mov ecx, dword [rbp + 0xf]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp - 9]
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x1600ccc46
call fcn.160069078
test eax, eax
jns 0x1600ccc46
lea rcx, [rbp - 0x11]
call fcn.1600c0874
inc r14d
cmp r14d, dword [rbp - 0x15]
jb 0x1600ccbf0
mov rcx, rbx
call fcn.160031c48
mov rcx, qword [r12]
lea r8, [rbp + 0x17]
xor eax, eax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
lea edx, [rax + 1]
mov dword [rbp + 0x2f], eax
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
jne 0x1600cccc6
call fcn.160069078
mov esi, eax
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1600ccd50
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
cmp dword [0x16027449c], 0
mov esi, r9d
movzx ebp, r8w
mov edi, edx
mov rbx, rcx
jne 0x1600ccdcf
call fcn.1600cdd28
test al, al
jne 0x1600ccdcf
mov rcx, rbx
call fcn.1600cccf4
test eax, eax
je 0x1600ccdd4
call fcn.16006f058
test al, al
je 0x1600ccdcf
and qword [rsp + 0x40], 0
mov r9d, edi
mov rax, qword [rsp + 0x80]
movzx edx, bp
movzx r8d, word [rbx + 0x68]
mov rcx, qword [rbx + 0x60]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov word [rsp + 0x28], si
and qword [rsp + 0x20], 0
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1600cd74c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor esi, esi
cmp byte [0x160273d69], sil
je 0x1600cd8a0
cmp byte [0x160273d68], sil
mov byte [0x160273d69], sil
jne 0x1600cd7a0
call fcn.1600cde54
mov byte [0x160273d68], 1
lea rax, [rbp - 9]
mov r9d, 1
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleState
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call fcn.16005ab8c
test eax, eax
jne 0x1600cd8a0
mov ebx, esi
mov rcx, qword [rbp - 9]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x15]
lea rax, [rbp + 0x17]
mov dword [rbp - 0x15], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x2f]
lea rax, [rbp - 0x11]
mov dword [rbp + 0x17], esi
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rsi
mov qword [rbp + 0x1b], rsi
mov qword [rbp + 0x23], rsi
mov dword [rbp - 0x19], reloc.OLEAUT32.dll_SafeArrayLock
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
mov edi, eax
test eax, eax
jne 0x1600cd88c
cmp dword [rbp - 0x11], 3
jne 0x1600cd88c
cmp dword [rbp - 0x19], 0x14
jne 0x1600cd88c
mov ecx, dword [rbp - 0x15]
add rcx, rcx
cmp rcx, 0x20
jae 0x1600cd8c5
mov word [rbp + rcx + 0x2f], si
lea rdx, [rbp - 0xd]
lea rcx, [rbp + 0x2f]
call fcn.1600cdfb4
test al, al
je 0x1600cd88c
mov eax, dword [rbp - 0xd]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 1]
mov dword [rbp + 0x13], eax
mov dword [rbp - 1], esi
mov qword [rbp + 3], rsi
mov qword [rbp + 0xb], rsi
call fcn.1600cd974
test al, al
je 0x1600cd88c
lea rcx, [rbp - 1]
call fcn.1600cda90
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleLastReported
lea rcx, [rbp - 1]
call fcn.1600cdc68
inc ebx
test edi, edi
je 0x1600cd7cc
mov rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.16006e884
int3
Function at 0x1600cda90
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rbx, rcx
call fcn.1600cda80
test al, al
je 0x1600cdc46
mov eax, dword [rcx + 0x14]
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleLastReported
and dword [rsp + 0x58], 0
lea rcx, [rsp + 0x58]
and qword [rsp + 0x5c], 0
and dword [rsp + 0x64], 0
and dword [rsp + 0x68], 0
mov dword [rsp + 0x6c], eax
call fcn.1600cd9b0
test al, al
je 0x1600cdb17
mov eax, dword [rbx]
cmp dword [rsp + 0x58], eax
jne 0x1600cdb17
mov rax, qword [rbx + 4]
cmp qword [rsp + 0x5c], rax
jne 0x1600cdb17
mov eax, dword [rbx + 0x10]
cmp dword [rsp + 0x68], eax
je 0x1600cdc46
mov r9d, dword [rbx + 0x14]
lea r8, [0x1601d65a4]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rbp - 0x60]
call fcn.160059e34
test eax, eax
js 0x1600cdc46
mov r9d, dword [rbx + 0x10]
lea r8, [0x1601fb58c]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rbp - 0x40]
call fcn.160059e34
test eax, eax
js 0x1600cdc46
imul rax, qword [rbx + 4], 0x2710
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x50]
shr rax, 0x20
mov dword [rsp + 0x54], eax
call qword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_FileTimeToSystemTime]
test eax, eax
je 0x1600cdc46
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x1600cdc46
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.api_ms_win_core_datetime_l1_1_0.dll_GetTimeFormatW]
test eax, eax
jle 0x1600cdc46
lea rax, [0x1601d4934]
xor ecx, ecx
mov qword [rbp - 0x80], rax
lea rdx, str.Windows_Search_Service
lea rax, [rbp - 0x60]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x68], rax
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1600cdc46
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x80]
mov ecx, 4
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov r9d, 0x800003f7
mov word [rsp + 0x28], cx
and qword [rsp + 0x20], 0
lea edx, [rcx - 2]
lea r8d, [rcx - 3]
mov rcx, rbx
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_DeregisterEventSource]
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x208]
add rsp, 0x1f0
pop rbp
ret