joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c7b0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x1400512d0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.14001c140
mov rdx, qword [rdi + 0x58]
xor ecx, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14001c861
mov rcx, qword [rdi + 0x58]
mov edx, 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rcx
xor ecx, ecx
lea r9d, [rdx + 1]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], rcx
mov r8d, edx
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140021670
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret

Function at 0x14001c890
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbx
push rsi
sub rsp, 0x298
mov rax, qword [0x1400512d0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rdx
mov rsi, rcx
lea rdx, [rsp + 0x72]
mov r8d, 0x106
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movsxd rcx, eax
test eax, eax
jne 0x14001c8e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.1400230dc
jmp 0x14001c958
lea eax, [rcx + 2]
mov edx, 0x22
mov word [rsp + rcx*2 + 0x72], dx
movsxd rcx, eax
mov word [rsp + 0x70], dx
add rcx, rcx
cmp rcx, 0x20c
jae 0x14001ca16
mov qword [rsp + 0x2c0], rbp
xor ebp, ebp
xor edx, edx
mov word [rsp + rcx + 0x70], bp
lea r8d, [rbp + 3]
xor ecx, ecx
mov qword [rsp + 0x290], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14001c972
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140045fb0]
mov edx, eax
call fcn.1400230dc
mov rbp, qword [rsp + 0x2c0]
mov rdi, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140021670
add rsp, 0x298
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rbp
lea rax, [0x140040d7c]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x70]
mov r9d, 4
mov r8, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
jne 0x14001c9e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.1400230dc
jmp 0x14001c9f6
lea rcx, str._s_is_installed._n
mov rdx, rsi
call fcn.1400230dc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14001c948
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001c948
call fcn.140022cf0
int3
Function at 0x14001ccb0
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400512d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdi, rcx
xor edx, edx
lea r8d, [rax + 1]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14001cd38
test byte [0x1400512b0], 2
je 0x14001cd1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenSCManager_failed_w_err_0x_08lx_n
lea edx, [rsi + 2]
lea rcx, str.StopService
mov r9d, eax
call fcn.1400205a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140045fb0]
mov edx, eax
call fcn.1400230dc
jmp 0x14001ce95
mov r8d, 0x24
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14001cd9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x424
je 0x14001ce79
test byte [0x1400512b0], 2
je 0x14001cd8c
lea r8, str.OpenSCManager_failed_w_err_0x_08lx_n
lea edx, [rbx + 2]
lea rcx, str.StopService
mov r9d, eax
call fcn.1400205a0
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
mov edx, edi
call fcn.1400230dc
jmp 0x14001ce79
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14001ce79
lea rcx, str.Stopping__s.
mov rdx, rdi
call fcn.1400230dc
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14001ce12
nop dword [rax + rax]
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x14001ce16
lea rcx, [0x140042314]
call fcn.1400230dc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14001cde0
mov eax, dword [rsp + 0x24]
cmp eax, 1
jne 0x14001ce46
test byte [0x1400512b0], 2
je 0x14001ce3d
lea r8, str._n_s_is_stopped._n
lea edx, [rax + 1]
lea rcx, str.StopService
mov r9, rdi
call fcn.1400206a0
lea rcx, str._n_s_is_stopped._n
jmp 0x14001ce71
test byte [0x1400512b0], 2
je 0x14001ce6a
lea r8, str._n_s_failed_to_stop._n
lea rcx, str.StopService
mov r9, rdi
mov edx, 2
call fcn.1400206a0
lea rcx, str._n_s_failed_to_stop._n
mov rdx, rdi
call fcn.1400230dc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14001ce90
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140021670
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14001ceb0
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov ebp, edx
mov rsi, rcx
test edx, edx
je 0x14001ced7
neg r8d
sbb ebx, ebx
add ebx, 3
jmp 0x14001cee1
mov ebx, 4
call fcn.14001ccb0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14001cf38
test byte [0x1400512b0], 2
je 0x14001cf1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenSCManager_failed___d__n
lea edx, [rdi + 2]
lea rcx, str.EnableOrDisableService
mov r9d, eax
call fcn.1400206a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed___d__n
mov edx, eax
call fcn.1400230dc
jmp 0x14001d068
mov r8d, 2
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14001cf93
test byte [0x1400512b0], 2
je 0x14001cf7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenService_failed___d__n
lea edx, [rsi + 2]
lea rcx, str.EnableOrDisableService
mov r9d, eax
call fcn.1400206a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenService_failed___d__n
mov edx, eax
call fcn.1400230dc
jmp 0x14001d05f
xor eax, eax
or r9d, 0xffffffff
mov r8d, ebx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
or edx, r9d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14001d00f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ChangeServiceConfig_failed___d__n
mov edx, eax
call fcn.1400230dc
test byte [0x1400512b0], 2
je 0x14001d056
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str._nChangeServiceConfig_failed___d__n
lea rcx, str.EnableOrDisableService
mov r9d, eax
mov edx, 2
call fcn.1400206a0
jmp 0x14001d056
lea rax, str.enabled
lea rbx, str.disabled
test ebp, ebp
cmovne rbx, rax
lea rcx, str.Service__s_successfully._n
mov rdx, rbx
call fcn.1400230dc
test byte [0x1400512b0], 2
je 0x14001d056
lea r8, str.Service__s_successfully._n
lea rcx, str.EnableOrDisableService
mov r9, rbx
mov edx, 2
call fcn.1400206a0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14001d8f0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001d910
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001d99a
cmp qword [rbx + 0x18], 8
jb 0x14001d927
mov rcx, qword [rbx]
jmp 0x14001d92a
mov rcx, rbx
mov edx, 0x80
call fcn.140023d44
cmp qword [rbx + 0x18], 8
jb 0x14001d940
mov rcx, qword [rbx]
jmp 0x14001d943
mov rcx, rbx
call fcn.140023ec4
test eax, eax
je 0x14001d969
cmp qword [rbx + 0x18], 8
jb 0x14001d958
mov rcx, qword [rbx]
jmp 0x14001d95b
mov rcx, rbx
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x14001d99a
test byte [0x1400512b0], 2
je 0x14001d99a
cmp qword [rbx + 0x18], 8
jb 0x14001d97e
mov r9, qword [rbx]
jmp 0x14001d981
mov r9, rbx
lea r8, str.Succeeded_to_remove_file:__s_n
mov edx, 2
lea rcx, str.ForceDeleteAFile
call fcn.1400206a0
nop
cmp qword [rbx + 0x18], 8
jb 0x14001d9a9
mov rcx, qword [rbx]
call fcn.140021650
mov qword [rbx + 0x18], 7
xor eax, eax
mov qword [rbx + 0x10], rax
mov word [rbx], ax
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14001f030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov eax, dword [0x1400534d8]
test al, 1
jne 0x14001f09a
or eax, 1
mov dword [0x1400534d8], eax
mov qword [0x1400534d0], 7
mov qword [0x1400534c8], r14
mov word [0x1400534b8], r14w
lea rcx, [0x140037550]
call fcn.140021820
cmp qword [0x1400534c8], 0
jne 0x14001f1ec
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14001ff50
nop
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.1400201c0
test eax, eax
je 0x14001f1e2
mov word [rsp + 0x70], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call fcn.140024640
mov dword [rsp + 0x2c8], 0x208
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x2c8]
lea r8, [rsp + 0x70]
lea rdx, str.ProgDir
lea rcx, [rsp + 0x40]
call fcn.140020f80
test eax, eax
je 0x14001f1e2
cmp word [rsp + 0x70], 0
jne 0x14001f142
mov r8, r14
jmp 0x14001f15b
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001f150
lea rdx, [rsp + 0x70]
lea rcx, [0x1400534b8]
call fcn.14000e180
mov edx, 0x5c
or r8, 0xffffffffffffffff
lea rcx, [0x1400534b8]
call fcn.14000d170
mov rcx, qword [0x1400534c8]
dec rcx
cmp rax, rcx
je 0x14001f1a9
mov r8d, 1
lea rdx, [0x140040d4c]
lea rcx, [0x1400534b8]
call fcn.14000efd0
test byte [0x1400512b0], 2
je 0x14001f1e2
lea r9, [0x1400534b8]
cmp qword [0x1400534d0], 8
cmovae r9, qword [0x1400534b8]
lea r8, str.SynProgDir___s_n
mov edx, 2
lea rcx, str.GetSynRegistryProgDirEx
call fcn.1400206a0
nop
lea rcx, [rsp + 0x38]
call fcn.140020070
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov dword [rsp + 0x30], 1
cmp qword [0x1400534c8], 0
je 0x14001f29b
mov r8, rdi
lea rdx, [0x1400534b8]
lea rcx, [rsp + 0x38]
call fcn.14000ece0
mov rsi, rax
cmp rbx, rax
je 0x14001f258
cmp qword [rbx + 0x18], 8
jb 0x14001f23d
mov rcx, qword [rbx]
call fcn.140021650
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov rdx, rsi
mov rcx, rbx
call fcn.14000da70
cmp qword [rsp + 0x50], 8
jb 0x14001f26a
mov rcx, qword [rsp + 0x38]
call fcn.140021650
test ebp, ebp
je 0x14001f29b
cmp qword [rbx + 0x18], 8
jb 0x14001f27a
mov rcx, qword [rbx]
jmp 0x14001f27d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001f29b
xor r8d, r8d
lea rdx, [0x140040d7c]
mov rcx, rbx
call fcn.14000e180
nop
cmp qword [rdi + 0x18], 8
jb 0x14001f2aa
mov rcx, qword [rdi]
call fcn.140021650
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
mov rax, rbx
add rsp, 0x280
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001f700
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x288]
sub rsp, 0x360
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, r9
mov r14d, r8d
mov rbx, rdx
mov rdi, rcx
mov edx, 0x104
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x68], 7
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp word [rbp + 0x50], r15w
jne 0x14001f76a
mov r8d, r15d
jmp 0x14001f77c
lea rax, [rbp + 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x14001f772
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14000e180
nop
lea r8, [0x140040d4c]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14000ec00
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000eca0
nop
cmp qword [rbp - 0x78], 8
jb 0x14001f7c4
mov rcx, qword [rsp + 0x70]
call fcn.140021650
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r15
mov word [rsp + 0x70], r15w
cmp qword [rsp + 0x68], 8
jb 0x14001f7e8
mov rcx, qword [rsp + 0x50]
call fcn.140021650
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
lea rax, [rbp - 0x70]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r15
mov word [rbp - 0x70], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.14000dc10
nop
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r15
mov word [rbp - 0x50], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000dc10
nop
mov dword [rsp + 0x20], r15d
mov r9d, 0x440
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14001faa0
test eax, eax
je 0x14001f8fe
test r14d, r14d
je 0x14001f8a3
or edx, 0xffffffff
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rsi, rsi
je 0x14001f898
mov rdx, rsi
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x48], 8
jb 0x14001f8b5
mov rcx, qword [rsp + 0x30]
call fcn.140021650
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r15
mov word [rsp + 0x30], r15w
cmp qword [rdi + 0x18], 8
jb 0x14001f8d8
mov rcx, qword [rdi]
call fcn.140021650
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
cmp qword [rbx + 0x18], 8
jb 0x14001f8f7
mov rcx, qword [rbx]
call fcn.140021650
mov eax, 1
jmp 0x14001f954
cmp qword [rsp + 0x48], 8
jb 0x14001f910
mov rcx, qword [rsp + 0x30]
call fcn.140021650
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r15
mov word [rsp + 0x30], r15w
cmp qword [rdi + 0x18], 8
jb 0x14001f933
mov rcx, qword [rdi]
call fcn.140021650
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
cmp qword [rbx + 0x18], 8
jb 0x14001f952
mov rcx, qword [rbx]
call fcn.140021650
xor eax, eax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r15
mov word [rbx], r15w
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001faa0
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rbp
mov esi, r9d
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp qword [rdx + 0x18], 8
jb 0x14001fadd
mov rcx, qword [rdx]
jmp 0x14001fae0
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001fb52
test byte [0x1400512b0], 1
je 0x14001fb1c
cmp qword [rbx + 0x18], 8
jb 0x14001fb00
mov r9, qword [rbx]
jmp 0x14001fb03
mov r9, rbx
lea r8, str.File_does_not_exist:__s_n
mov edx, 1
lea rcx, str.SynShellExecute
call fcn.1400206a0
nop
cmp qword [rbx + 0x18], 8
jb 0x14001fb2b
mov rcx, qword [rbx]
call fcn.140021650
mov qword [rbx + 0x18], 7
xor esi, esi
mov qword [rbx + 0x10], rsi
mov word [rbx], si
cmp qword [rdi + 0x18], 8
jb 0x14001fb4b
mov rcx, qword [rdi]
call fcn.140021650
xor eax, eax
jmp 0x14001fc35
test byte [0x1400512b0], 2
je 0x14001fb96
cmp qword [rdi + 0x18], 8
jb 0x14001fb67
mov rax, qword [rdi]
jmp 0x14001fb6a
mov rax, rdi
cmp qword [rbx + 0x18], 8
jb 0x14001fb76
mov r9, qword [rbx]
jmp 0x14001fb79
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str._s_nArguments:_s
mov edx, 2
lea rcx, str.SynShellExecute
call fcn.1400206a0
xor edx, edx
lea r8d, [rdx + 0x70]
mov rcx, r14
call fcn.140024640
mov dword [r14], 0x70
mov dword [r14 + 4], esi
xor esi, esi
mov qword [r14 + 8], rsi
lea rax, str.open
mov qword [r14 + 0x10], rax
cmp qword [rbx + 0x18], 8
jb 0x14001fbcc
mov rax, qword [rbx]
jmp 0x14001fbcf
mov rax, rbx
mov qword [r14 + 0x18], rax
cmp qword [rdi + 0x18], 8
jb 0x14001fbdf
mov rax, qword [rdi]
jmp 0x14001fbe2
mov rax, rdi
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], rsi
mov eax, esi
cmp dword [rsp + 0x80], 1
sete al
mov dword [r14 + 0x30], eax
mov rcx, r14
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebp, eax
cmp qword [rbx + 0x18], 8
jb 0x14001fc15
mov rcx, qword [rbx]
call fcn.140021650
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
cmp qword [rdi + 0x18], 8
jb 0x14001fc33
mov rcx, qword [rdi]
call fcn.140021650
mov eax, ebp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140020c20
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x10], 0xffffffff80000002
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x140020c61
cmp dword [rcx + 0x18], 0
jne 0x140020c61
lea rdx, str.RegistryEx.cpp
lea rcx, str.m_hKey___HKEY_LOCAL_MACHINE__m_bWriteHKLM
mov r8d, 0x2e9
call fcn.1400015d0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140020cee
test rsi, rsi
je 0x140020cee
xor ebx, ebx
mov qword [rsp + 0x78], rcx
test rdi, rdi
je 0x140020cbc
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov rdx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140020cee
mov rcx, qword [rsp + 0x78]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test rdi, rdi
je 0x140020cd7
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x50
pop rdi
ret

Function at 0x140020d00
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
je 0x140020d24
test rdx, rdx
jne 0x140020d3d
lea rdx, str.RegistryEx.cpp
lea rcx, str.m_hKey__pszSubKeyNameBuf
mov r8d, 0x2d3
call fcn.1400015d0
mov edx, dword [rbx + 0x20]
mov rcx, qword [rbx + 0x10]
mov r9d, esi
lea eax, [rdx + 1]
mov r8, rdi
mov dword [rbx + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140020d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push r14
sub rsp, 0x48
xor ebx, ebx
mov r14, r9
mov rbp, rdx
mov esi, ebx
test r9, r9
je 0x140020d90
mov esi, dword [r9]
test rdx, rdx
je 0x140020f6c
cmp qword [rsp + 0x80], rbx
je 0x140020f6c
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x40], rdi
test rcx, rcx
je 0x140020e0f
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x30], rcx
test rdi, rdi
je 0x140020e5a
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140020e5a
test byte [0x1400512b0], 4
je 0x140020e0f
lea r8, str.Couldnt_open_subkey:__s_n
lea rcx, str.CRegistryEx::GetDWORD
mov r9, rdi
mov edx, 3
call fcn.1400205a0
test r14, r14
je 0x140020f5b
test byte [0x1400512b0], 4
je 0x140020e3c
lea r8, str.Returning_default_value:_0x_08X_n
lea rcx, str.CRegistryEx::GetDWORD
mov r9d, esi
mov edx, 3
call fcn.1400205a0
mov rax, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x40]
mov dword [rax], esi
mov eax, 1
add rsp, 0x48
pop r14
pop rsi
pop rbp
pop rbx
ret
test byte [0x1400512b0], 4
je 0x140020e7e
lea r8, str.Opened_subkey:__s_n
lea rcx, str.CRegistryEx::GetDWORD
mov r9, rdi
mov edx, 3
call fcn.1400205a0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x88], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
test rdi, rdi
je 0x140020ecb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x140020efc
test byte [0x1400512b0], 4
je 0x140020e0f
lea r8, str.Error_querying_value:__d_n
lea rcx, str.CRegistryEx::GetDWORD
mov r9d, ebp
mov edx, 3
call fcn.1400205a0
jmp 0x140020e0f
test byte [0x1400512b0], 4
je 0x140020f2d
mov eax, dword [rsp + 0x78]
lea r9, [rsp + 0x80]
lea r8, str.Read_0x_08X_successfully._Type_d._n
lea rcx, str.CRegistryEx::GetDWORD
mov edx, 3
mov dword [rsp + 0x20], eax
call fcn.1400205a0
mov eax, dword [rsp + 0x78]
cmp eax, 4
je 0x140020f45
cmp eax, 3
jne 0x140020f4a
cmp dword [rsp + 0x88], 4
jne 0x140020f4a
mov ebx, 1
mov eax, ebx
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
pop r14
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
pop r14
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x48
pop r14
pop rsi
pop rbp
pop rbx
ret