joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b9810
Capabilities:
Encode data using xor
Encrypt data using dpapi
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
lea r9, [rsp + 0x60]
mov dword [rsp + 0x30], esi
mov r8, rax
mov dword [rsp + 0x28], esi
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400b9965
mov rcx, qword [rsp + 0x60]
lea edx, [rsi + 4]
xor r9d, r9d
mov qword [rsp + 0x20], 0x61c
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x1400b9944
mov edx, 0x610
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400b9939
mov rcx, rax
lea rdx, [rdi + 0xc]
mov r8d, 0x610
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0x610
lea r8d, [rsi + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_SystemFunction041]
test eax, eax
jne 0x1400b9922
mov r9d, dword [rbx + 0x400]
lea r10, [rbx + 0x404]
test r9d, r9d
je 0x1400b98fb
mov rdx, r10
mov r8d, r9d
mov cl, byte [rdx]
mov al, cl
xor al, sil
mov sil, cl
xor al, 0x43
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x1400b98dd
mov r9d, dword [rbx + 0x400]
mov eax, dword [rbx + 0x604]
lea r8, [rbx + 0x200]
mov dword [rsp + 0x28], eax
lea rcx, str._Username__:__s_n_Domain____:__s_n_Password__:__.s_n_flags_type:_0x_08x_n
mov rdx, rbx
mov qword [rsp + 0x20], r10
call fcn.14000bdc4
jmp 0x1400b9930
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___RtlDecryptMemory:_0x_08x_n
call fcn.14000bdc4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x1400b9958
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___MapViewOfFile__0x_08x__n
call fcn.14000bdc4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b9979
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___DuplicateHandle__0x_08x__n
call fcn.14000bdc4
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c065c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
xor ebp, ebp
xor r9d, r9d
and qword [rax - 0x38], rbp
mov edx, 0x80000000
and dword [rax - 0x40], ebp
lea r8d, [rbp + 3]
mov dword [rax - 0x48], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400c07a0
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400c0781
mov r12d, 0x10000000
lea ecx, [rbp + 0x40]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400c0795
mov rax, qword [rsp + 0x80]
xor ecx, ecx
test rax, rax
jle 0x1400c0776
lea r14, [rcx + 0x10000000]
mov rbx, rax
sub rbx, rcx
mov rdx, rcx
cmp r14, rax
mov rcx, rsi
cmovl rbx, r12
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400c074e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c073f
mov edx, dword [rsp + 0x78]
mov rcx, rdi
call fcn.1400c0554
add ebp, eax
jmp 0x1400c0762
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___ReadFile__0x_08x__n
jmp 0x1400c075b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___SetFilePointerEx__0x_08x__n
mov edx, eax
call fcn.14000bdc4
mov rax, qword [rsp + 0x80]
mov rcx, r14
cmp r14, rax
jl 0x1400c06e7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400c0795
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___GetFileSizeEx__0x_08x__n
call fcn.14000bdc4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400c07b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___CreateFile__0x_08x__n
call fcn.14000bdc4
mov rbx, qword [rsp + 0x70]
mov eax, ebp
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004724
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x14000f0e0]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov rdi, rcx
mov dword [rsp + 0x50], edx
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov ebx, eax
cmp dword [0x14000f108], 0xffffffff
jne 0x14000482e
cmp byte [0x1400100da], sil
mov r9d, 0x20019
mov dword [0x14000f108], esi
mov qword [rsp + 0x60], rsi
jne 0x140004794
cmp byte [0x14000fdc4], sil
mov eax, 0x20119
cmovne r9d, eax
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsInstaller
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000482e
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, str.Debug
lea rax, [rsp + 0x58]
mov dword [rsp + 0x78], 0x28
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x80]
mov dword [rsp + 0x58], 0x50
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004811
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax]
and ecx, 3
mov dword [0x14000f108], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x78], 0x28
jle 0x14000482e
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x14000fc14], esi
je 0x140004907
cmp dword [rsp + 0x50], esi
je 0x140004907
cmp byte [0x1400100da], sil
mov eax, 0x20006
mov qword [rsp + 0x58], rsi
jne 0x140004866
cmp byte [0x14000fdc4], sil
mov ecx, 0x20106
cmovne eax, ecx
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInstallerCA
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140004907
mov rcx, qword [rsp + 0x58]
lea r9d, [rax + 4]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and al, 0x20
lea rdx, str.LastError
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x58]
lea rdx, str.LastErrorMessage
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [0x1654bdcb8]
xchg edx, eax
movsb byte [rdi], byte [rsi]
shr cl, cl
je 0x1400048b8
pop rbp
scasb al, byte [rdi]
frstor dword [rdx - 0xb]
jp 0x1400048d2
invalid
Function at 0x140009b00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x990]
sub rsp, 0xa90
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp + 0x980], rax
mov rbx, r8
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x180]
call fcn.140028230
lea r14, [rbp + 0x9d8]
call fcn.140004670
mov qword [rsp + 0x30], r14
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x28], 0
mov r9, 0xffffffffffffffff
mov r8d, 0x400
mov qword [rsp + 0x20], rbx
mov rcx, qword [rax]
call fcn.140034268
test dword [rdi + 0x64c], esi
je 0x140009b9c
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
lea rcx, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x40], rax
mov r8d, 0x200
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call fcn.140028230
test sil, 1
je 0x140009bf3
lea r8, str.ZONE_ERROR
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 2
je 0x140009c0f
lea r8, str.ZONE_WARN
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 4
je 0x140009c2b
lea r8, str.ZONE_FUNCTION
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 8
je 0x140009c47
lea r8, str.ZONE_VERBOSE
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 0x10
je 0x140009c63
lea r8, str.ZONE_EVENT
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 0x40
je 0x140009c7f
lea r8, str.ZONE_GET
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, sil
jns 0x140009c9a
lea r8, str.ZONE_SRVEVENT
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 8
jae 0x140009cb6
lea r8, str.ZONE_VERBOSE_2
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 9
jae 0x140009cd2
lea r8, str.ZONE_EVENTLOG
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 0xa
jae 0x140009cee
lea r8, str.ZONE_EVENTLOG_VERBOSE_2
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
lea rax, [rbp + 0x180]
mov edx, 0x200
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str._FMAPOService__s::_s
lea rcx, [rbp - 0x80]
call fcn.140002050
mov rcx, qword [rbp + 0x980]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0xa90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000a8c0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.1400256f0
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1510], rbx
mov qword [rsp + 0x1518], rsi
mov r14d, edx
mov r15, rcx
mov rsi, qword [rbp + 0x1428]
xor r12d, r12d
mov word [rbp + 0x3d0], r12w
mov byte [rbp - 0x30], r12b
mov rbx, qword [rbp + 0x1430]
mov ecx, dword [rbx]
mov dword [rsp + 0x38], ecx
mov eax, dword [rbx + 4]
mov dword [rsp + 0x3c], eax
call fcn.140004ca0
mov edi, eax
mov dword [rsp + 0x30], 3
mov ecx, r12d
mov eax, 8
cmp byte [rbx + 8], cl
cmovne ecx, eax
mov dword [rsp + 0x34], ecx
mov ecx, 1
lock xadd dword [0x140081218], ecx
inc ecx
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x50], eax
lea rax, str.c:usersdivynslindesktopmy_pcnb_forte_svn_fmservice_code_fmservice_1_w11_all_fmservice_1_88_unitestpackagesmicrosoft.windows.implementationlibrary.1.0.210204.1includewil_resource.h
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x74], edi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], r15
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov rax, qword [0x1400812c8]
test rax, rax
je 0x14000a9c4
call rax
mov qword [rbp - 0x50], rax
jmp 0x14000a9c8
mov qword [rbp - 0x50], r12
mov rax, qword [0x1400812d8]
test rax, rax
je 0x14000a9e5
mov r8d, 0x400
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x1400812d0]
test rax, rax
je 0x14000a9f8
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x140081290]
test rax, rax
je 0x14000aa0b
lea rcx, [rsp + 0x30]
call rax
cmp dword [rsp + 0x38], r12d
jl 0x14000aa28
mov dword [rsp + 0x38], 0x8000ffff
mov ecx, 0x8000ffff
call fcn.140004ee0
mov dword [rsp + 0x3c], eax
cmp byte [0x140081301], r12b
jne 0x14000aa79
mov rax, qword [0x140081308]
test rax, rax
je 0x14000aa45
call rax
movzx r12d, al
jmp 0x14000aa51
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000aa79
mov rax, qword [0x140081310]
test rax, rax
je 0x14000aacf
cmp byte [0x1400812f0], r12b
jne 0x14000aacf
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call rax
jmp 0x14000aacf
mov rax, qword [0x140081310]
test rax, rax
je 0x14000aaa2
cmp byte [0x1400812f0], 0
jne 0x14000aaa2
mov r8d, 0x800
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x30]
call rax
cmp word [rbp + 0x3d0], 0
jne 0x14000aac2
lea r8, [rsp + 0x30]
mov edx, 0x800
lea rcx, [rbp + 0x3d0]
call fcn.140004800
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140081300], 0
je 0x14000aae7
mov rax, qword [0x1400812c0]
test rax, rax
je 0x14000aae7
call rax
nop
lea rcx, [rsp + 0x30]
call fcn.140005dc0
int3
Function at 0x14000ab00
Capabilities:
Print debug messages

Disassembly:
jmp 0x14000ad40
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13e0]
mov eax, 0x14e0
call fcn.1400256f0
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp + 0x13d0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1448]
xor r12d, r12d
mov word [rbp + 0x3d0], r12w
mov byte [rbp - 0x30], r12b
mov rdx, qword [rbp + 0x1450]
mov ecx, dword [rdx]
mov dword [rsp + 0x38], ecx
mov eax, dword [rdx + 4]
mov dword [rsp + 0x3c], eax
call fcn.140004c60
mov ebx, eax
mov r8d, 1
mov dword [rsp + 0x30], r8d
mov ecx, r12d
mov eax, 8
cmp byte [rdx + 8], cl
cmovne ecx, eax
mov dword [rsp + 0x34], ecx
lock xadd dword [0x140081218], r8d
inc r8d
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x74], ebx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], r15
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov rax, qword [0x1400812c8]
test rax, rax
je 0x14000ae42
call rax
mov qword [rbp - 0x50], rax
jmp 0x14000ae46
mov qword [rbp - 0x50], r12
mov rax, qword [0x1400812d8]
test rax, rax
je 0x14000ae63
mov r8d, 0x400
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x1400812d0]
test rax, rax
je 0x14000ae76
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x140081290]
test rax, rax
je 0x14000ae89
lea rcx, [rsp + 0x30]
call rax
cmp dword [rsp + 0x38], r12d
jge 0x14000af74
cmp byte [0x140081301], r12b
jne 0x14000aee5
mov rax, qword [0x140081308]
test rax, rax
je 0x14000aeb1
call rax
movzx r12d, al
jmp 0x14000aebd
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000aee5
mov rax, qword [0x140081310]
test rax, rax
je 0x14000af3b
cmp byte [0x1400812f0], r12b
jne 0x14000af3b
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call rax
jmp 0x14000af3b
mov rax, qword [0x140081310]
test rax, rax
je 0x14000af0e
cmp byte [0x1400812f0], 0
jne 0x14000af0e
mov r8d, 0x800
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x30]
call rax
cmp word [rbp + 0x3d0], 0
jne 0x14000af2e
lea r8, [rsp + 0x30]
mov edx, 0x800
lea rcx, [rbp + 0x3d0]
call fcn.140004800
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140081300], 0
je 0x14000af53
mov rax, qword [0x1400812c0]
test rax, rax
je 0x14000af53
call rax
nop
mov rcx, qword [rbp + 0x13d0]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x14e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140006010
nop
int3
Function at 0x14000ad40
Capabilities:
Print debug messages

Disassembly:
jmp 0x14000ad40
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13e0]
mov eax, 0x14e0
call fcn.1400256f0
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp + 0x13d0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1448]
xor r12d, r12d
mov word [rbp + 0x3d0], r12w
mov byte [rbp - 0x30], r12b
mov rdx, qword [rbp + 0x1450]
mov ecx, dword [rdx]
mov dword [rsp + 0x38], ecx
mov eax, dword [rdx + 4]
mov dword [rsp + 0x3c], eax
call fcn.140004c60
mov ebx, eax
mov r8d, 1
mov dword [rsp + 0x30], r8d
mov ecx, r12d
mov eax, 8
cmp byte [rdx + 8], cl
cmovne ecx, eax
mov dword [rsp + 0x34], ecx
lock xadd dword [0x140081218], r8d
inc r8d
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x74], ebx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], r15
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov rax, qword [0x1400812c8]
test rax, rax
je 0x14000ae42
call rax
mov qword [rbp - 0x50], rax
jmp 0x14000ae46
mov qword [rbp - 0x50], r12
mov rax, qword [0x1400812d8]
test rax, rax
je 0x14000ae63
mov r8d, 0x400
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x1400812d0]
test rax, rax
je 0x14000ae76
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x140081290]
test rax, rax
je 0x14000ae89
lea rcx, [rsp + 0x30]
call rax
cmp dword [rsp + 0x38], r12d
jge 0x14000af74
cmp byte [0x140081301], r12b
jne 0x14000aee5
mov rax, qword [0x140081308]
test rax, rax
je 0x14000aeb1
call rax
movzx r12d, al
jmp 0x14000aebd
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000aee5
mov rax, qword [0x140081310]
test rax, rax
je 0x14000af3b
cmp byte [0x1400812f0], r12b
jne 0x14000af3b
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call rax
jmp 0x14000af3b
mov rax, qword [0x140081310]
test rax, rax
je 0x14000af0e
cmp byte [0x1400812f0], 0
jne 0x14000af0e
mov r8d, 0x800
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x30]
call rax
cmp word [rbp + 0x3d0], 0
jne 0x14000af2e
lea r8, [rsp + 0x30]
mov edx, 0x800
lea rcx, [rbp + 0x3d0]
call fcn.140004800
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140081300], 0
je 0x14000af53
mov rax, qword [0x1400812c0]
test rax, rax
je 0x14000af53
call rax
nop
mov rcx, qword [rbp + 0x13d0]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x14e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140006010
nop
int3
Function at 0x140016080
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
test byte [rcx + 0x298], 4
mov rbx, rcx
je 0x14001609f
lea rcx, str.Enter_Metering::Metering_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbx + 0x3a0]
test rcx, rcx
je 0x1400160b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 0x310]
test rcx, rcx
je 0x1400160c3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x2f0]
test rcx, rcx
je 0x1400160d5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x330]
mov qword [rbx + 0x3a0], 0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rbx + 0x358]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test byte [rbx + 0x298], 4
je 0x140016110
lea rcx, str.Leave_Metering::Metering_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140016125
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov qword [rbx], 0
mov rcx, qword [rbx + 0x3b8]
test rcx, rcx
je 0x140016137
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbx + 0x3b0]
test rcx, rcx
je 0x140016149
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, vtable.RpcServer::CM_MMEndpointNotify.0
mov qword [rbx + 0x2e8], 0
lea rcx, [rbx + 0x2b8]
mov qword [rbx + 0x2b0], rax
call fcn.14000af80
lea rcx, [rbx + 8]
add rsp, 0x20
pop rbx
jmp fcn.140020ea0
Function at 0x1400171b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xf90]
mov eax, 0x1090
call fcn.1400256f0
sub rsp, rax
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov rbx, r8
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.140028230
lea r14, [rbp + 0xfd8]
call fcn.140004670
mov qword [rsp + 0x30], r14
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x28], 0
mov r9, 0xffffffffffffffff
mov r8d, 0x400
mov qword [rsp + 0x20], rbx
mov rcx, qword [rax]
call fcn.140034268
test dword [rdi + 0x298], esi
je 0x140017249
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
test sil, 1
je 0x14001728d
lea r8, str.ZONE_ERROR
lea edx, [rax + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 2
je 0x1400172a9
lea r8, str.ZONE_WARN
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 4
je 0x1400172c5
lea r8, str.ZONE_FUNCTION
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 8
je 0x1400172e1
lea r8, str.ZONE_VERBOSE
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 0x10
je 0x1400172fd
lea r8, str.ZONE_EVENT
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 0x40
je 0x140017319
lea r8, str.ZONE_GET
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, sil
jns 0x140017334
lea r8, str.ZONE_SRVEVENT
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 8
jae 0x140017350
lea r8, str.ZONE_VERBOSE_2
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 9
jae 0x14001736c
lea r8, str.ZONE_EVENTLOG
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 0xa
jae 0x140017388
lea r8, str.ZONE_EVENTLOG_VERBOSE_2
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x800
call fcn.140028230
lea rax, [rbp - 0x80]
mov edx, 0x800
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str._Metering__s::_s
lea rcx, [rbp + 0x780]
call fcn.140002050
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x1090
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400173e0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rbx, r8
lea rcx, [rsp + 0x60]
mov edi, edx
mov r8d, 0x800
xor edx, edx
call fcn.140028230
lea rsi, [rsp + 0x8a8]
call fcn.140004670
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x60]
xor esi, esi
mov r8d, 0x400
mov qword [rsp + 0x28], rsi
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
lea r9, [rsi - 1]
call fcn.140034268
lea rdx, str.FMService_EventLog
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400174ae
mov qword [rsp + 0x40], rsi
lea edx, [rsi + 1]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x50], rcx
xor r9d, r9d
lea rcx, [0x140068320]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], dx
movzx edx, di
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x870
pop rdi
pop rsi
pop rbx
ret