joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b4cc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x48], 0
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007b530
test byte [rcx + 0x1c], 2
je 0x14007b530
cmp byte [rcx + 0x19], 5
jb 0x14007b530
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008df8]
mov edx, 0xa
call fcn.14000ffa8
lea rax, [rsp + 0x48]
mov r9d, 0x3001f
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x14007b59f
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007b69d
test byte [rcx + 0x1c], 2
je 0x14007b69d
cmp byte [rcx + 0x19], 2
jb 0x14007b69d
mov edx, 0xb
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008df8]
mov r9d, ebx
call fcn.1400100e0
jmp 0x14007b69d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
jmp 0x14007b5e2
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call fcn.14007b4cc
xor ecx, ecx
cmp eax, ecx
je 0x14007b6a5
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
je 0x14007b5b5
cmp eax, 0x103
jne 0x14007b65b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
je 0x14007b654
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007b69d
test byte [rcx + 0x1c], 2
je 0x14007b69d
cmp byte [rcx + 0x19], 2
jb 0x14007b69d
mov edx, 0xd
jmp 0x14007b587
mov eax, 1
jmp 0x14007b6a7
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007b692
test byte [rcx + 0x1c], 2
je 0x14007b692
cmp byte [rcx + 0x19], 2
jb 0x14007b692
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008df8]
mov edx, 0xc
mov r9d, ebx
call fcn.1400100e0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14008c5b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14007b6d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r13
sub rsp, 0x40
and dword [rax - 0x28], 0
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov dword [rax + 0x20], 4
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x14007b72f
test byte [rcx + 0x1c], 2
je 0x14007b72f
cmp byte [rcx + 0x19], 5
jb 0x14007b72f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008df8]
mov edx, 0xe
call fcn.14000ffa8
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14007b787
mov rcx, qword [str.P5_n_]
cmp rcx, r13
je 0x14007b81b
test byte [rcx + 0x1c], 2
je 0x14007b81b
cmp byte [rcx + 0x19], 2
jb 0x14007b81b
mov edx, 0xf
jmp 0x14007b808
cmp dword [rsp + 0x78], 4
je 0x14007b7c2
mov rcx, qword [str.P5_n_]
cmp rcx, r13
je 0x14007b7bb
test byte [rcx + 0x1c], 2
je 0x14007b7bb
cmp byte [rcx + 0x19], 2
jb 0x14007b7bb
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008df8]
mov edx, 0x10
call fcn.14000ffa8
mov ebx, 0x3f1
jmp 0x14007b81b
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14007b81b
mov rcx, qword [str.P5_n_]
cmp rcx, r13
je 0x14007b81b
test byte [rcx + 0x1c], 2
je 0x14007b81b
cmp byte [rcx + 0x19], 2
jb 0x14007b81b
mov edx, 0x11
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008df8]
mov r9d, eax
call fcn.1400100e0
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret
Function at 0x14007cc40
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x150
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x140], rax
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
call sub.msvcrt.dll_memset
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14007cca6
test byte [rcx + 0x1c], 2
je 0x14007cca6
cmp byte [rcx + 0x19], 5
jb 0x14007cca6
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008d00]
mov edx, 0xa
call fcn.14000ffa8
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14007cd01
mov rax, qword [str.P5_n_]
cmp rax, rdi
je 0x14007ccfa
test byte [rax + 0x1c], 2
je 0x14007ccfa
cmp byte [rax + 0x19], 2
jb 0x14007ccfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140008d00]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0xc
call fcn.1400100e0
xor eax, eax
jmp 0x14007cde4
cmp dword [rsp + 0x30], 2
je 0x14007cd37
mov rcx, qword [str.P5_n_]
cmp rcx, rdi
je 0x14007ccfa
test byte [rcx + 0x1c], 2
je 0x14007ccfa
cmp byte [rcx + 0x19], 3
jb 0x14007ccfa
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008d00]
call fcn.14000ffa8
jmp 0x14007ccfa
cmp dword [rsp + 0x24], 5
jae 0x14007cd5d
mov rcx, qword [str.P5_n_]
cmp rcx, rdi
je 0x14007ccfa
test byte [rcx + 0x1c], 2
je 0x14007ccfa
cmp byte [rcx + 0x19], 3
jb 0x14007ccfa
mov edx, 0xe
jmp 0x14007cd25
mov cl, byte [rsp + 0x138]
mov eax, 0x40
test al, cl
je 0x14007cd7d
cmp byte [rsp + 0x13a], 1
lea ecx, [rax - 0x20]
cmove eax, ecx
jmp 0x14007cde4
mov eax, 0x200
test word [rsp + 0x138], ax
je 0x14007cd93
mov eax, 1
jmp 0x14007cde4
test cl, 2
je 0x14007cd9f
mov eax, 8
jmp 0x14007cde4
mov eax, 0x80
test al, cl
je 0x14007cdaf
mov eax, 0x10
jmp 0x14007cde4
mov ecx, 0x400
test word [rsp + 0x138], cx
jne 0x14007cde4
mov cl, byte [rsp + 0x13a]
cmp cl, 1
jne 0x14007cdd1
mov eax, 2
jmp 0x14007cde4
cmp cl, 3
je 0x14007cddf
cmp cl, 2
jne 0x14007ccfa
mov eax, 4
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14008c5b0
add rsp, 0x150
pop rdi
ret
Function at 0x14007e5ac
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, 0x206
lea rcx, [rsp + 0x42]
xor esi, esi
mov r8, rbx
xor edx, edx
mov word [rsp + 0x40], si
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x252]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x250], si
call sub.msvcrt.dll_memset
cmp qword [0x14009e3f0], 0xffffffffffffffff
je 0x14007e61e
lock add dword [0x1400a417c], 1
mov eax, 1
jmp 0x14007e69a
mov ebx, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [0x14000a1d0]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
je 0x14007e698
cmp eax, ebx
ja 0x14007e698
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rsi
jne 0x14007e6bf
lea rdx, [rsp + 0x250]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
je 0x14007e698
lea rax, [rsp + 0x40]
lea rdi, [0x1400a4190]
lea r9, [rsp + 0x250]
lea r8, [0x14000a148]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400118ac
cmp eax, esi
jge 0x14007e70b
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14008c5b0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rdi, [0x1400a4190]
lea r8, [rsp + 0x40]
mov edx, esi
mov rcx, rdi
sub r8, rdi
lea rax, [rbx + 0x7ffffefa]
cmp rax, rsi
je 0x14007e6f6
movzx eax, word [r8 + rcx]
cmp ax, si
je 0x14007e6f6
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x14007e6d3
cmp rbx, rsi
jne 0x14007e704
sub rcx, 2
mov edx, 0x8007007a
cmp edx, esi
mov word [rcx], si
jl 0x14007e698
mov dword [rsp + 0x38], 2
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea r8d, [r9 + 3]
or ebx, 0xffffffff
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov dword [0x14009e3ec], ebx
mov dword [rsp + 0x20], 4
call fcn.140079cec
mov qword [0x14009e3f0], rax
cmp rax, 0xffffffffffffffff
je 0x14007e698
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, ebx
jne 0x14007e788
mov rcx, qword [0x14009e3f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [0x14009e3f0], 0xffffffffffffffff
jmp 0x14007e698
mov eax, 1
xchg dword [0x1400a417c], eax
jmp 0x14007e617
Function at 0x14007e7a0
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
sub rsp, 0x868
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rdi, rcx
lea rcx, [rsp + 0x52]
xor ebx, ebx
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x50], bx
call sub.msvcrt.dll_memset
cmp dword [0x1400a43ac], ebx
jne 0x14007e893
lea rax, [rsp + 0x40]
lea rdx, [0x14000a168]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x14007e825
mov eax, ebx
jmp 0x14007e879
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x14000d700]
xor r8d, r8d
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x14007e866
cmp dword [rsp + 0x34], 4
je 0x14007e86a
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x880]
mov dword [0x14009e37c], eax
mov dword [0x1400a43ac], 1
jmp 0x14007e899
mov eax, dword [0x14009e37c]
cmp eax, ebx
jle 0x14007e925
mov r8, rdi
mov edi, 0x3ff
lea r9, [rsp + 0x888]
lea rcx, [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.msvcrt.dll__vsnwprintf]
cmp eax, ebx
jl 0x14007e925
cdqe
cmp rax, rdi
ja 0x14007e925
jne 0x14007e8d4
mov word [rsp + 0x84e], bx
or rcx, 0xffffffffffffffff
xor eax, eax
mov edx, 0x3fd
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
mov edi, 0xa
not rcx
dec rcx
cmp rcx, rdx
cmovb edx, ecx
lea eax, [rdx - 1]
cmp word [rsp + rax*2 + 0x50], di
je 0x14007e91a
lea eax, [rdx + 1]
lea ecx, [rdi + 3]
mov word [rsp + rax*2 + 0x50], di
lea eax, [rdx + 2]
mov word [rsp + rdx*2 + 0x50], cx
mov word [rsp + rax*2 + 0x50], bx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14008c5b0
add rsp, 0x868
pop rdi
pop rbx
ret
Function at 0x14007edfc
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
xor ebp, ebp
mov r12, r9
mov r13, r8
xor ebx, ebx
mov r14, rdx
mov rdi, rcx
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007ee5b
test byte [rcx + 0x1c], 2
je 0x14007ee5b
cmp byte [rcx + 0x19], 5
jb 0x14007ee5b
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0xa]
lea r8, [0x140008cb0]
call fcn.14000ffa8
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14007eead
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007ef63
test byte [rcx + 0x1c], 2
je 0x14007ef63
cmp byte [rcx + 0x19], 2
jb 0x14007ef63
lea edx, [rsi + 0xb]
jmp 0x14007ef40
mov r8d, dword [rsp + 0x88]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x14007eef5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007ef63
test byte [rcx + 0x1c], 2
je 0x14007ef63
cmp byte [rcx + 0x19], 2
jb 0x14007ef63
lea edx, [rbp + 0xc]
jmp 0x14007ef40
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x14007ef5b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14007ef55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007ef63
test byte [rcx + 0x1c], 2
je 0x14007ef63
cmp byte [rcx + 0x19], 2
jb 0x14007ef63
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008cb0]
mov r9d, ebx
call fcn.1400100e0
jmp 0x14007ef63
mov eax, dword [rsp + 0x24]
mov dword [rdi], eax
mov qword [r13], rsi
mov qword [r12], rbp
test ebx, ebx
je 0x14007ef72
mov rdx, rbp
mov rcx, rsi
call fcn.14007ef9c
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x14007f0a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x20
mov rcx, qword [str.P5_n_]
lea r12, str.P5_n_
cmp rcx, r12
je 0x14007f0e9
test byte [rcx + 0x1c], 2
je 0x14007f0e9
cmp byte [rcx + 0x19], 5
jb 0x14007f0e9
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008cb0]
mov edx, 0x11
call fcn.14000ffa8
mov ebx, 0x100000
lea r8, [0x14000d760]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
jne 0x14007f200
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14007f157
mov rax, qword [str.P5_n_]
cmp rax, r12
je 0x14007f150
test byte [rax + 0x1c], 2
je 0x14007f150
cmp byte [rax + 0x19], 2
jb 0x14007f150
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x12
mov rcx, qword [str.P5_n_]
lea r8, [0x140008cb0]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
xor eax, eax
jmp 0x14007f200
mov r8d, 0x1f0003
mov edx, ebx
mov ecx, ebx
call fcn.14007ff00
mov rsi, rax
test rax, rax
jne 0x14007f191
mov rax, qword [str.P5_n_]
cmp rax, r12
je 0x14007f150
test byte [rax + 0x1c], 2
je 0x14007f150
cmp byte [rax + 0x19], 2
jb 0x14007f150
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [rsi + 0x13]
jmp 0x14007f136
xor r8d, r8d
lea r9, [0x14000d760]
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14007f1e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x14007f1e8
test byte [rcx + 0x1c], 2
je 0x14007f1e8
cmp byte [rcx + 0x19], 2
jb 0x14007f1e8
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x14]
lea r8, [0x140008cb0]
mov r9d, eax
call fcn.1400100e0
mov rcx, rsi
call fcn.140080470
test rbx, rbx
jne 0x14007f1fd
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret
Function at 0x140080598
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x40
mov esi, r8d
mov rbx, rcx
mov rcx, qword [str.P5_n_]
lea r12, str.P5_n_
lea r13, [0x140008cb0]
cmp rcx, r12
je 0x1400805ee
test byte [rcx + 0x1c], 2
je 0x1400805ee
cmp byte [rcx + 0x19], 5
jb 0x1400805ee
mov rcx, qword [rcx + 0x10]
mov edx, 0x4c
mov r8, r13
call fcn.14000ffa8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140080636
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x1400806cb
test byte [rcx + 0x1c], 2
je 0x1400806cb
cmp byte [rcx + 0x19], 2
jb 0x1400806cb
mov edx, 0x4d
jmp 0x1400806bc
cmp dword [rsp + 0x24], 1
jne 0x140080644
xor eax, eax
jmp 0x1400806cd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
jmp 0x140080685
mov r9d, dword [rsp + 0x24]
cmp r9d, 1
je 0x14008063d
cmp r9d, 3
jne 0x140080718
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, esi
ja 0x1400806e8
mov eax, dword [rsp + 0x38]
mov ecx, 0x1388
shr eax, 1
cmp eax, ecx
cmovb ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14008064e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x1400806cb
test byte [rcx + 0x1c], 2
je 0x1400806cb
cmp byte [rcx + 0x19], 2
jb 0x1400806cb
mov edx, 0x4e
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.1400100e0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x40
pop r13
ret
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140080711
test byte [rcx + 0x1c], 2
je 0x140080711
cmp byte [rcx + 0x19], 2
jb 0x140080711
mov rcx, qword [rcx + 0x10]
mov edx, 0x50
mov r8, r13
call fcn.14000ffa8
mov eax, 0x5b4
jmp 0x1400806cd
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140080741
test byte [rcx + 0x1c], 2
je 0x140080741
cmp byte [rcx + 0x19], 2
jb 0x140080741
mov rcx, qword [rcx + 0x10]
mov edx, 0x4f
mov r8, r13
call fcn.1400100e0
mov eax, 0x426
jmp 0x1400806cd
Function at 0x140080a30
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, ecx
mov ebp, r8d
mov rsi, rdx
xor ebx, ebx
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call sub.msvcrt.dll_memset
mov rcx, qword [str.P5_n_]
lea r14, str.P5_n_
cmp rcx, r14
je 0x140080aa3
test byte [rcx + 0x1c], 2
je 0x140080aa3
cmp byte [rcx + 0x19], 5
jb 0x140080aa3
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xa]
lea r8, [0x140008c80]
call fcn.14000ffa8
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
mov edi, eax
jge 0x140080af5
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140080b3c
test byte [rcx + 0x1c], 2
je 0x140080b3c
cmp byte [rcx + 0x19], 2
jb 0x140080b3c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c80]
mov edx, 0xb
mov r9d, eax
call fcn.1400100e0
jmp 0x140080b3c
lea r8, [rsp + 0x30]
mov rdx, rbp
mov rcx, rsi
call fcn.14001191c
cmp eax, ebx
mov edi, eax
jge 0x140080b47
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140080b3c
test byte [rcx + 0x1c], 2
je 0x140080b3c
cmp byte [rcx + 0x19], 2
jb 0x140080b3c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c80]
movzx r9d, ax
mov edx, 0xc
call fcn.1400100e0
movzx ecx, di
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140080b4c
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008c5b0
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140080b74
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x680
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rbx, rcx
mov edi, 0x208
lea rcx, [r11 - 0x226]
xor ebp, ebp
xor edx, edx
mov r8, rdi
mov word [rsp + 0x460], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x42]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x40], bp
call sub.msvcrt.dll_memset
lea r8d, [rdi - 2]
lea rcx, [rsp + 0x252]
xor edx, edx
mov word [rsp + 0x250], bp
call sub.msvcrt.dll_memset
mov dword [rsp + 0x34], 0x20a
cmp rbx, rbp
je 0x140080db8
lea r9d, [rbp + 1]
lea rdx, [0x14000d668]
mov rcx, 0xffffffff80000001
mov r8d, r9d
mov word [rbx], bp
call fcn.14007ac98
mov rdi, rax
cmp rax, rbp
je 0x140080db8
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
lea rdx, [0x14000d820]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x140080c76
cmp esi, 2
jne 0x140080db8
lea rdi, [0x14000d840]
jmp 0x140080cce
cmp dword [rsp + 0x30], 1
je 0x140080c88
cmp dword [rsp + 0x30], 2
jne 0x140080db8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdi, [rsp + 0x40]
mov r11d, eax
dec eax
cmp eax, 0x103
ja 0x140080cce
lea eax, [r11 - 1]
cmp word [rsp + rax*2 + 0x40], 0x5c
je 0x140080cce
lea r8, [0x14000cf2c]
lea rcx, [rsp + 0x40]
mov edx, 0x105
call fcn.140019338
cmp eax, ebp
jl 0x140080daf
lea rdx, [rsp + 0x460]
mov r8d, 0x105
mov ecx, 5
call fcn.140080a30
cmp eax, ebp
jne 0x140080d03
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14000d878]
mov edx, eax
call fcn.14007e7a0
jmp 0x140080db8
mov esi, 0x104
lea r8, [rsp + 0x460]
mov rcx, rbx
mov rdx, rsi
call fcn.14001191c
cmp eax, ebp
jl 0x140080daf
cmp word [rdi], 0x5c
je 0x140080d3f
lea r8, [0x14000cf2c]
mov rdx, rsi
mov rcx, rbx
call fcn.140019338
cmp eax, ebp
jl 0x140080daf
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140019338
cmp eax, ebp
jl 0x140080daf
lea rax, [rsp + 0x250]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [0x14000d8b8]
mov edx, 0x8005
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
cmp eax, ebp
jl 0x140080daf
lea rdx, [0x14000d8f0]
lea rcx, [rsp + 0x250]
mov r8d, 0x93d
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
cmp eax, ebp
jl 0x140080daf
mov rcx, rbx
call fcn.140077a90
mov eax, 1
jmp 0x140080dba
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.14008c5b0
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret