joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400104e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r14d, dx
mov rbx, rcx
mov esi, 0xffff
cmp si, dx
jne 0x14001052a
xor eax, eax
jmp 0x1400106f8
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140010567
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140010567
lea ecx, [r9 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], r14w
movzx eax, r14w
jmp 0x1400106f8
cmp qword [rcx + 0x90], 0
je 0x1400106f5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x80]
cmp qword [r8], rax
jne 0x1400105a3
mov rdx, qword [rcx + 0x70]
mov rcx, qword [rcx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub rdx, rcx
sar rdx, 1
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x1400105cc
mov rdx, qword [rbx + 0x90]
movzx ecx, r14w
call fcn.14002f94c
cmp ax, si
je 0x1400106f5
movzx esi, r14w
jmp 0x1400106f5
mov word [rbp - 1], r14w
mov qword [rbp + 0x1f], reloc.OLEAUT32.dll_SafeArrayDestroy
xor eax, eax
mov qword [rbp + 0x17], rax
mov byte [rbp + 7], al
xor r8d, r8d
lea edx, [rax + 8]
lea rcx, [rbp + 7]
call fcn.14000eac0
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 1]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x1400106e5
cmp eax, 1
jg 0x1400106c7
lea rax, [rbp + 7]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x1f]
cmp r10, 0x10
cmovae rax, r9
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x140010692
lea rcx, [rbp + 7]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.14002f1d0
cmp rdi, rax
jne 0x1400106e5
mov byte [rbx + 0x82], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x1400106e1
test rdi, rdi
jne 0x1400105f2
cmp qword [rbp + 0x17], 0x20
jae 0x1400106e5
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.14000e9a0
jmp 0x1400105f2
cmp eax, 3
jne 0x1400106e5
mov rdx, qword [rbx + 0x90]
movzx ecx, word [rbp - 1]
call fcn.14002f94c
cmp ax, si
je 0x1400106e5
movzx esi, r14w
cmp qword [rbp + 0x1f], 0x10
jb 0x1400106f5
mov rcx, qword [rbp + 7]
call fcn.14002d04c
movzx eax, si
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14002d810
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012ed0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140012efe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140016a70
cmp byte [0x14006a220], 0
jne 0x140012f49
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012f39
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14006a220], 1
mov qword [0x14006a218], rax
jmp 0x140012f50
mov rax, qword [0x14006a218]
mov byte [0x14006a220], 1
jmp 0x140012f50
mov rax, qword [0x14006a218]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140012f6f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140016ae4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140016aff
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140016aff
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140016aff
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov edi, 0x8ca8d72e
mov ch, 0x47
pmaddwd mm7, mm7
pop rcx
invalid
Function at 0x1400142c0
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.1400145a0
test eax, eax
je 0x1400142f1
mov eax, 1
jmp 0x1400143f8
lea rdx, [rsp + 0x72]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400144ee
cmp eax, 0x104
je 0x1400144ee
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x140014537
mov qword [rsp + 0xaa8], rbx
mov qword [rsp + 0xab0], rsi
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140014411
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80a
call fcn.140012080
test eax, eax
jne 0x1400143cf
lea r8, str.Could_not_open_Service_Manager
lea rcx, [rsp + 0x280]
mov edx, 0x400
call fcn.140030748
test eax, eax
je 0x1400143cf
cmp eax, 0xc
je 0x14001450b
cmp eax, 0x16
je 0x140014500
cmp eax, 0x22
je 0x140014500
cmp eax, 0x50
jne 0x1400144f5
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14002d810
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
add rdi, 0x68
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x1400144d2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80b
call fcn.140012080
test eax, eax
jne 0x1400144c7
lea r8, str.Could_not_start_service
lea rcx, [rsp + 0x280]
mov edx, 0x400
call fcn.140030748
test eax, eax
je 0x1400144c7
cmp eax, 0xc
je 0x14001452c
cmp eax, 0x16
je 0x140014521
cmp eax, 0x22
je 0x140014521
cmp eax, 0x50
jne 0x140014516
xor r9d, r9d
mov r8, rdi
jmp 0x1400143d6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x1400143e8
xor eax, eax
jmp 0x1400143f8
mov ecx, 0x80004005
call fcn.140007130
int3
mov ecx, 0x80070057
call fcn.140007130
int3
mov ecx, 0x8007000e
call fcn.140007130
int3
mov ecx, 0x80004005
call fcn.140007130
int3
mov ecx, 0x80070057
call fcn.140007130
int3
mov ecx, 0x8007000e
call fcn.140007130
int3
call fcn.140030580
int3
Function at 0x1400167d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.140014990
mov ebx, eax
test eax, eax
jne 0x1400168f7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400168d1
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400167d0
mov ebx, eax
test eax, eax
jne 0x1400168f7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140016880
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400168e6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.140012ed0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140016907
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14002d810
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016a70
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140012efe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140016a70
cmp byte [0x14006a220], 0
jne 0x140012f49
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012f39
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14006a220], 1
mov qword [0x14006a218], rax
jmp 0x140012f50
mov rax, qword [0x14006a218]
mov byte [0x14006a220], 1
jmp 0x140012f50
mov rax, qword [0x14006a218]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140012f6f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140016ae4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140016aff
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140016aff
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140016aff
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov edi, 0x8ca8d72e
mov ch, 0x47
pmaddwd mm7, mm7
pop rcx
invalid
Function at 0x140016d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.14002d840
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140016dac
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140016dac
call fcn.140012050
mov ebx, eax
jmp 0x140016ed4
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140016dcd
call fcn.140012050
jmp 0x140016ec3
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140016df0
call fcn.140012050
jmp 0x140016ec3
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140016e12
mov ebx, 0x8007000e
jmp 0x140016ec5
mov ecx, eax
test eax, eax
je 0x140016e4a
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140016e40
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140016e4a
lea rcx, [rsp + 0x70]
call fcn.140011ec0
jmp 0x140016e54
mov ecx, 0x80070216
call fcn.140007130
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140016e67
cmp qword [rsp + 0x70], 0
jne 0x140016e76
mov ebx, 0x8007000e
jmp 0x140016ec5
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140016ea0
call fcn.140012050
jmp 0x140016ec3
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140016b20
mov ebx, eax
test rdi, rdi
je 0x140016ed4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140016eeb
lea rcx, [rsp + 0x70]
call fcn.140012fc0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14002d810
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140017db0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002d810
add rsp, 0x48
ret

Function at 0x140017eb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
lea rdx, str.LaunchPermission
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], 0
mov esi, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x140017f33
lea r9d, [rax + 1]
lea rdx, str.LaunchPermission
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140017f33
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1400184b0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x1400184c8
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400184d4
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x1400184d0
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x140018680
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140067250]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor eax, eax
xor r12d, r12d
mov rdi, rcx
mov r15d, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x48]
lea r8, str.AppID
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x58], r12
call fcn.140014990
mov ebx, eax
test eax, eax
je 0x140018707
mov dword [rdi + 0x27c], eax
jmp 0x14001886a
mov rdx, qword [rsp + 0x48]
xor eax, eax
lea r8, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x40], r12
call fcn.140014990
mov ebx, eax
test eax, eax
jne 0x140018852
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
lea rdx, str.LocalService
xor r8d, r8d
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x1400187be
mov eax, dword [rsp + 0x64]
dec eax
cmp eax, 1
jbe 0x140018798
lea ecx, [rbx + 0xd]
jmp 0x1400187be
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400187b6
test al, 1
jne 0x1400187af
shr rax, 1
cmp word [rbp + rax*2 - 0x72], r12w
je 0x1400187bb
mov ecx, SafeArrayGetDim
jmp 0x1400187be
mov word [rbp - 0x70], r12w
mov ecx, r12d
test ecx, ecx
mov eax, r12d
mov edx, 1
cmove eax, edx
mov dword [rdi + 0x28c], eax
test eax, eax
je 0x140018816
lea rax, [rdi + 0x68]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x68], rax
lea rax, [0x14001a600]
mov qword [rbp - 0x80], r12
mov qword [rsp + 0x70], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14001880e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x27c], eax
mov ebx, dword [rdi + 0x27c]
jmp 0x140018858
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x140018841
cmp eax, 0x80010106
jne 0x140018858
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140018845
jmp 0x140018858
mov byte [rdi + 0x62], 1
mov edx, r15d
mov rcx, rdi
call fcn.140017670
mov ebx, eax
mov dword [rdi + 0x27c], eax
cmp qword [rsp + 0x30], r12
je 0x14001886a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x48], r12
je 0x14001887c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14002d810
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rbp
ret
Function at 0x1400196d0
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x58
call fcn.140019270
test eax, eax
jne 0x1400196e7
mov eax, 0x80004005
add rsp, 0x58
ret
xor eax, eax
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r8, str.AppID
lea rcx, [rsp + 0x38]
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
call fcn.140014990
test eax, eax
je 0x14001973a
mov ecx, eax
call fcn.140012070
mov ebx, eax
jmp 0x1400197b0
mov rdx, qword [rsp + 0x38]
xor eax, eax
lea r8, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov r9d, 0x20006
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], rbx
call fcn.140014990
test eax, eax
je 0x140019782
mov ecx, eax
call fcn.140012070
jmp 0x14001979b
mov rcx, qword [rsp + 0x20]
lea rdx, str.LocalService
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
call fcn.140019d40
cmp qword [rsp + 0x20], 0
mov ebx, eax
je 0x1400197b0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x38], 0
je 0x1400197c3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x416a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416bc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x013d0070]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430060
xorps xmm15, xmm15
mov r14, qword [0x01475f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416ab6
mov rbx, qword [rsp + 0x60]
jmp 0x416aca
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
sub rax, rbx
add rcx, rbx
mov rbx, rax
test rbx, rbx
jbe 0x416aee
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rax, rbx
jmp 0x416b02
cmp rbx, 0x1000
jae 0x416ac1
jmp 0x416b7a
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
cmp rbx, 0x1000
jae 0x416b0f
xor edx, edx
jmp 0x416b71
mov qword [rsp + 0x30], rbx
mov rax, qword [0x013d0070]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax + rax]
call fcn.00430060
xorps xmm15, xmm15
mov r14, qword [0x01475f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
test dl, dl
jne 0x416af8
jmp 0x416ae0
call fcn.0045d340
xorps xmm15, xmm15
mov r14, qword [0x01475f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 8
jne 0x416baa
lea rax, [0x00f7e087]
mov ebx, 0xd
call fcn.00432b60
cmp eax, 0x5af
je 0x416b99
lea rax, [0x00f7fe49]
mov ebx, 0x1f
nop dword [rax]
call fcn.00432b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00459720
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416a40