joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006e91c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140109328]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rcx, r9
mov rdx, qword [r8]
mov rdi, r9
mov r8d, dword [rdx - 0x10]
call fcn.140004588
mov r8d, 1
lea rdx, [0x1400de2f4]
mov rcx, rdi
call fcn.140004588
mov r9, qword [rbx]
or rbx, 0xffffffffffffffff
mov rdx, rbx
xor esi, esi
inc rdx
cmp word [r9 + rdx*2], si
jne 0x14006e96c
mov eax, 0x811c9dc5
mov r8, rsi
add rdx, rdx
je 0x14006e998
movzx ecx, byte [r8 + r9]
inc r8
imul eax, eax, 0x1000193
xor eax, ecx
cmp r8, rdx
jb 0x14006e983
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x20]
mov ecx, eax
lea r8d, [r9 + 0x11]
call qword [sym.imp.msvcrt.dll__ultow_s]
lea rax, [rsp + 0x20]
inc rbx
cmp word [rax + rbx*2], si
jne 0x14006e9b4
mov r8d, ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140004588
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400cc650
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140080764
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call fcn.1400044b4
mov ebx, eax
test eax, eax
js 0x140080859
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov r9d, 0x20219
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferencesHME_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x1400807de
mov rax, qword [rdi + 0x88]
test rax, rax
je 0x1400807d2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rdi + 0x88], 0
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x88], rax
test ecx, ecx
jne 0x14008084b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0xa0], rax
test rax, rax
je 0x140080844
mov rcx, rdi
call fcn.1400816ec
mov ebx, eax
test eax, eax
js 0x140080859
xor edx, edx
mov rcx, rdi
call fcn.140080c2c
mov ebx, eax
test eax, eax
js 0x140080859
and qword [rsp + 0x28], 0
lea r8, [0x140081750]
and dword [rsp + 0x20], 0
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0xa8], rax
jmp 0x140080859
mov ebx, 0x8000ffff
jmp 0x140080859
movzx ebx, cx
or ebx, 0x80070000
test ecx, ecx
cmovle ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400817a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x48
and qword [rbp + 0x20], 0
lea r8, [rbp + 0x18]
and dword [rbp + 0x18], 0
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetGetJoinInformation]
mov rcx, qword [rbp + 0x20]
mov ebx, eax
test rcx, rcx
je 0x1400817d8
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
test ebx, ebx
jne 0x1400817e6
cmp dword [rbp + 0x18], 3
jne 0x1400817e6
mov bl, 1
jmp 0x1400817e8
xor bl, bl
lea rax, [rbp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlLsa
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008186c
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea r8, str.AllowOnlineID
lea rax, [rbp + 0x28]
mov dword [rbp + 0x18], 4
mov qword [rsp + 0x28], rax
lea rdx, str.Pku2u
lea rax, [rbp + 0x20]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140081862
cmp dword [rbp + 0x20], 4
jne 0x140081862
cmp dword [rbp + 0x28], eax
sete bl
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x140081938
Capabilities:
Create thread
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
or r14, 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
mov ebx, ebp
test rdx, rdx
jne 0x140081967
mov eax, ebp
jmp 0x140081973
mov rax, r14
inc rax
cmp word [rdx + rax*2], bp
jne 0x14008196a
mov r8d, eax
call fcn.140004f58
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x10], rax
mov r15d, 0x80070000
test rax, rax
jne 0x1400819b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140081a81
mov edx, 1
mov rcx, rsi
lea r8d, [rdx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov qword [rdi + 0x18], rax
cmp rax, r14
jne 0x1400819df
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140081a81
lea r9, [rsp + 0x50]
mov qword [rsp + 0x50], rbp
xor r8d, r8d
lea rcx, [0x1400e7cc8]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov ebx, eax
test eax, eax
js 0x140081a72
mov rcx, qword [rsp + 0x50]
mov edx, 1
lea r8d, [rdx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov qword [rdi + 0x20], rax
cmp rax, r14
jne 0x140081a37
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140081a72
mov qword [rsp + 0x28], rbp
lea r8, [0x1400822f0]
mov r9, rdi
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
jne 0x140081a72
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jns 0x140081aaf
mov rcx, qword [rdi + 0x18]
cmp rcx, r14
je 0x140081a94
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov qword [rdi + 0x18], r14
mov rcx, qword [rdi + 0x20]
cmp rcx, r14
je 0x140081aa7
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov qword [rdi + 0x20], r14
mov rcx, rdi
call fcn.14008286c
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400ae540
Capabilities:
Get routing table

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12, rdx
mov rcx, qword [0x140106190]
lea rdx, [0x140106190]
mov eax, 5
cmp rcx, rdx
je 0x1400ae597
test byte [rcx + 0x1c], 1
je 0x1400ae597
cmp byte [rcx + 0x19], al
jb 0x1400ae597
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x3c]
mov r9, r12
lea r8, [0x1400e7768]
call fcn.140003670
xor esi, esi
or eax, 0xffffffff
and dword [rsp + 0x50], esi
xor edi, edi
mov qword [rsp + 0x58], rsi
mov ebp, eax
mov r14d, eax
lea r15d, [rdi + 2]
test r12, r12
jne 0x1400ae5bf
mov ebx, 0x80004003
jmp 0x1400ae6ab
mov ecx, 0x3c
call fcn.1400cb8f0
mov rdi, rax
test rax, rax
jne 0x1400ae5db
mov ebx, 0x8007000e
jmp 0x1400ae6ab
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
mov ebx, eax
cmp eax, 0x7a
jne 0x1400ae632
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, dword [rsp + 0x50]
call fcn.1400cb8f0
mov rdi, rax
test rax, rax
je 0x1400ae5d1
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
test eax, eax
je 0x1400ae63c
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400ae638
or ebx, 0x80070000
test ebx, ebx
js 0x1400ae6ab
cmp dword [rdi], esi
jbe 0x1400ae666
mov ecx, dword [rdi]
lea rax, [rdi + 8]
cmp dword [rax - 4], esi
jne 0x1400ae65c
cmp dword [rax], esi
jne 0x1400ae65c
cmp dword [rax + 0x20], r14d
jae 0x1400ae65c
mov ebp, dword [rax + 0xc]
mov r14d, dword [rax + 0x20]
add rax, 0x38
sub rcx, 1
jne 0x1400ae646
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov ecx, r15d
call fcn.1400bf124
mov rsi, qword [rsp + 0x58]
mov ebx, eax
test eax, eax
js 0x1400ae6ab
mov rdx, rsi
test rsi, rsi
je 0x1400ae6a6
cmp dword [rdx + 4], ebp
je 0x1400ae71b
cmp ebp, 0xffffffff
jne 0x1400ae69d
cmp dword [rdx + 0x68], 1
je 0x1400ae71b
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x1400ae689
mov ebx, 0x80004005
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400ae702
test byte [rcx + 0x1c], 1
je 0x1400ae702
movzx eax, byte [rcx + 0x19]
test ebx, ebx
mov edx, 5
cmovns r15d, edx
cmp eax, r15d
jl 0x1400ae702
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e7768]
mov edx, 0x42
mov r9d, ebx
call fcn.140003634
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rdx, qword [rdx + 0x18]
test rdx, rdx
je 0x1400ae6a6
cmp qword [rdx + 0x10], 0
je 0x1400ae73d
cmp dword [rdx + 0x18], 0
jle 0x1400ae73d
movsxd rax, dword [rdx + 0x18]
cmp rax, 0x80
jbe 0x1400ae743
mov rdx, qword [rdx + 8]
jmp 0x1400ae71f
movsxd r8, dword [rdx + 0x18]
mov rcx, r12
mov rdx, qword [rdx + 0x10]
call sub.msvcrt.dll_memcpy
jmp 0x1400ae6ab
Function at 0x1400aee24
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140109328]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ebx, edx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
lea r12, [0x140106190]
mov rcx, qword [0x140106190]
mov r15d, 5
cmp rcx, r12
je 0x1400aee9d
test byte [rcx + 0x1c], 1
je 0x1400aee9d
cmp byte [rcx + 0x19], r15b
jb 0x1400aee9d
lea edx, [r15 + 0xa]
mov r9d, ebx
lea r8, [0x1400e7808]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsi + 0x80], ebx
and dword [rsi + 0x84], 0
cmp qword [rsi + 0x78], 0
je 0x1400aefc2
cmp qword [rsi + 0x38], 0
je 0x1400aef0e
xor ecx, ecx
cmp dword [rsi + 0x40], ecx
jbe 0x1400aeee6
mov rdx, qword [rsi + 0x30]
cmp qword [rdx + rcx*8], 0
jne 0x1400aeee0
inc ecx
cmp ecx, dword [rsi + 0x40]
jb 0x1400aeed0
jmp 0x1400aeee6
mov rcx, qword [rdx + rcx*8]
jmp 0x1400aeee8
xor ecx, ecx
mov qword [rsp + 0x30], rcx
test rcx, rcx
je 0x1400aef0e
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x30]
call fcn.14001943c
mov rcx, qword [rax]
and dword [rcx], 0
cmp qword [rsp + 0x30], 0
jne 0x1400aeef2
lea rcx, [0x1400e7ba0]
cmp qword [rsi + 0x78], 0
cmovne rcx, qword [rsi + 0x78]
mov r8d, 0x40
lea rdx, [rsp + 0x50]
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
jne 0x1400aef4e
mov ecx, 0x8007000e
call fcn.14000507c
int3
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov qword [rsi + 0x28], 1
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
call fcn.1400aeb00
mov r14d, eax
test eax, eax
js 0x1400aef9d
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400aec20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400aef9d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
jmp 0x1400aefc8
mov r14d, 0x80004005
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x1400af006
test byte [rcx + 0x1c], 1
je 0x1400af006
movzx edx, byte [rcx + 0x19]
mov eax, 2
test r14d, r14d
cmovns eax, r15d
cmp edx, eax
jl 0x1400af006
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r9d, r14d
lea r8, [0x1400e7808]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, r14d
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400cc650
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400af044
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140109328]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rcx
lea rsi, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, rsi
je 0x1400af0a8
test byte [rcx + 0x1c], 1
je 0x1400af0a8
mov edx, SafeArrayUnlock
lea r8, [0x1400e7808]
mov rcx, qword [rcx + 0x10]
call fcn.140003574
mov rax, qword [0x140108fd0]
lea rcx, [0x140108fd0]
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rsp + 0x28], rax
xor edi, edi
cmp qword [r14 + 0x28], rdi
je 0x1400af170
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
jbe 0x1400af106
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x1400af170
lea r9, str.wmpnsslog_02d.sqm
lea r8, [rsp + 0x40]
lea rdx, str._ws_ws
lea rcx, [rsp + 0x28]
call fcn.140008d6c
mov rcx, qword [0x140106190]
mov ebx, 2
cmp rcx, rsi
je 0x1400af157
test byte [rcx + 0x1c], bl
je 0x1400af157
cmp byte [rcx + 0x19], 4
jb 0x1400af157
lea edx, [rbx + 0x10]
mov r9, qword [rsp + 0x28]
lea r8, [0x1400e7808]
mov rcx, qword [rcx + 0x10]
call fcn.140003598
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
and qword [r14 + 0x28], 0
jmp 0x1400af175
mov ebx, 2
mov rcx, qword [0x140106190]
cmp rcx, rsi
je 0x1400af1b2
test byte [rcx + 0x1c], 1
je 0x1400af1b2
movzx eax, byte [rcx + 0x19]
mov edx, 5
test edi, edi
cmovns ebx, edx
cmp eax, ebx
jl 0x1400af1b2
mov edx, SafeArrayAccessData
mov r9d, edi
lea r8, [0x1400e7808]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400af1d8
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14006e230.0]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400cc650
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400b0cc4
Capabilities:
Modify service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov dword [rax + 0x10], edx
push r15
sub rsp, 0x60
mov rdi, rcx
mov rcx, qword [0x140106190]
lea r14, [0x140106190]
lea r15, [0x1400e78d8]
cmp rcx, r14
je 0x1400b0d3d
test byte [rcx + 0x1c], 1
je 0x1400b0d17
mov rcx, qword [rcx + 0x10]
mov edx, DispGetParam
mov r8, r15
call fcn.140003574
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400b0d3d
test byte [rcx + 0x1c], 2
je 0x1400b0d3d
cmp byte [rcx + 0x19], 4
jb 0x1400b0d3d
mov rcx, qword [rcx + 0x10]
mov edx, reloc.OLEAUT32.dll_DispGetParam
mov r8, r15
lea r9d, [rdx - 0x1a]
call fcn.140003634
mov edx, 1
mov rcx, rdi
call fcn.1400b1130
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400b0d78
test byte [rcx + 0x1c], 2
je 0x1400b0d78
cmp byte [rcx + 0x19], 4
jb 0x1400b0d78
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r9d, eax
mov r8, r15
call fcn.140003634
cmp ebx, 1
jne 0x1400b0e39
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x78]
lea edx, [rbx + 2]
mov dword [rsp + 0x78], ebx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ebx, eax
cmp eax, 1
je 0x1400b0dc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400b0e39
test byte [rcx + 0x1c], 2
je 0x1400b0e39
cmp byte [rcx + 0x19], 2
jb 0x1400b0e39
mov edx, 0x1d
jmp 0x1400b0e2a
mov rcx, qword [rdi + 0x10]
xor eax, eax
mov qword [rsp + 0x50], rax
or edx, 0xffffffff
mov qword [rsp + 0x48], rax
mov r9d, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
lea r8d, [rax + 2]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp eax, 1
je 0x1400b0e39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400b0e39
test byte [rcx + 0x1c], 2
je 0x1400b0e39
cmp byte [rcx + 0x19], 4
jb 0x1400b0e39
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r15
call fcn.140003634
mov rcx, rdi
call fcn.1400b136c
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400b0e6d
test byte [rcx + 0x1c], 1
je 0x1400b0e6d
cmp byte [rcx + 0x19], 5
jb 0x1400b0e6d
mov rcx, qword [rcx + 0x10]
mov edx, 0x1f
mov r9d, ebx
mov r8, r15
call fcn.140003634
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1400b0e8c
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x140106190]
lea rsi, [0x140106190]
cmp rcx, rsi
je 0x1400b0ecc
test byte [rcx + 0x1c], 1
je 0x1400b0ecc
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e78d8]
mov edx, 0x20
call fcn.140003574
xor edx, edx
mov rcx, rdi
call fcn.1400b1130
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, rsi
je 0x1400b0f08
test byte [rcx + 0x1c], 2
je 0x1400b0f08
cmp byte [rcx + 0x19], 4
jb 0x1400b0f08
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e78d8]
mov edx, 0x21
mov r9d, eax
call fcn.140003634
cmp ebx, 1
jne 0x1400b0f59
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
cmp eax, 1
je 0x1400b0f59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140106190]
cmp rcx, rsi
je 0x1400b0f59
test byte [rcx + 0x1c], 2
je 0x1400b0f59
cmp byte [rcx + 0x19], 4
jb 0x1400b0f59
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e78d8]
mov edx, 0x22
mov r9d, eax
call fcn.140003634
mov rcx, rdi
call fcn.1400b136c
mov rcx, qword [0x140106190]
cmp rcx, rsi
je 0x1400b0f91
test byte [rcx + 0x1c], 1
je 0x1400b0f91
cmp byte [rcx + 0x19], 5
jb 0x1400b0f91
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e78d8]
mov edx, 0x23
mov r9d, ebx
call fcn.140003634
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b0fac
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push r15
sub rsp, 0x60
mov rcx, qword [0x140106190]
lea r15, [0x140106190]
cmp rcx, r15
je 0x1400b0ff3
test byte [rcx + 0x1c], 1
je 0x1400b0ff3
cmp byte [rcx + 0x19], 5
jb 0x1400b0ff3
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e78d8]
mov edx, 0x33
lea r9d, [rdx - 0x31]
call fcn.140003634
and qword [rsp + 0x40], 0
lea r8, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x40]
and qword [rsp + 0x50], 0
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2011f
call fcn.14001b934
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, r15
je 0x1400b105e
test byte [rcx + 0x1c], 2
je 0x1400b105e
cmp byte [rcx + 0x19], 4
jb 0x1400b105e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e78d8]
mov edx, 0x34
mov r9d, eax
call fcn.140003634
mov rcx, qword [0x140106190]
test ebx, ebx
jne 0x1400b10ce
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SubStatus
mov dword [rsp + 0x78], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x140106190]
cmp rcx, r15
je 0x1400b1107
test byte [rcx + 0x1c], 2
je 0x1400b10ce
cmp byte [rcx + 0x19], 4
jb 0x1400b10ce
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e78d8]
mov edx, 0x35
mov r9d, eax
call fcn.140003634
mov rcx, qword [0x140106190]
cmp rcx, r15
je 0x1400b1107
test byte [rcx + 0x1c], 1
je 0x1400b1107
movzx r9d, byte [rcx + 0x19]
mov eax, ebx
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jl 0x1400b1107
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e78d8]
mov edx, 0x36
mov r9d, ebx
call fcn.140003634
cmp qword [rsp + 0x40], 0
je 0x1400b111a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop r15
ret
Function at 0x1400b3940
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
lea r13, [0x1400e7988]
cmp rcx, rax
je 0x1400b3999
test byte [rcx + 0x1c], 1
je 0x1400b3999
cmp byte [rcx + 0x19], 5
jb 0x1400b3999
mov rcx, qword [rcx + 0x10]
mov edx, 0x4a
mov r9, rbp
mov r8, r13
call fcn.140003598
mov rcx, qword [r14]
lea rax, [rsp + 0x70]
xor r15d, r15d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov dword [rsp + 0x70], r15d
mov rdx, rbp
mov dword [rsp + 0x88], r15d
mov edi, r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400b39f6
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x1400b39e6
lea ebx, [r15 + 0xd]
jmp 0x1400b39f6
mov edi, dword [rsp + 0x70]
mov ebx, r15d
shr edi, 1
mov dword [rsp + 0x88], edi
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400b3a32
test byte [r10 + 0x1c], 2
je 0x1400b3a32
cmp byte [r10 + 0x19], 4
jb 0x1400b3a32
mov rcx, qword [r10 + 0x10]
mov edx, 0x4b
mov r9d, ebx
mov r8, r13
call fcn.140003634
mov r10, qword [0x140106190]
test ebx, ebx
jne 0x1400b3b27
mov rax, qword [rsi]
lea ecx, [rbx + 1]
lea edx, [rdi + 2]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or ecx, eax
jge 0x1400b3a57
mov rcx, rsi
call fcn.140004ef4
mov r8, qword [rsi]
lea r9, [rsp + 0x88]
mov rdx, rbp
mov rcx, r14
call fcn.14001b9cc
mov ebx, eax
mov rcx, qword [0x140106190]
lea rdi, [0x140106190]
cmp rcx, rdi
je 0x1400b3aa2
test byte [rcx + 0x1c], 2
je 0x1400b3aa2
cmp byte [rcx + 0x19], 4
jb 0x1400b3aa2
mov rcx, qword [rcx + 0x10]
mov edx, 0x4c
mov r9d, eax
mov r8, r13
call fcn.140003634
mov eax, ebx
neg eax
sbb ecx, ecx
or rax, 0xffffffffffffffff
neg ecx
dec ecx
cmp ecx, eax
jne 0x1400b3ace
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400b3ac1
mov ecx, r15d
jmp 0x1400b3ad6
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400b3ac1
mov rcx, rax
test ecx, ecx
js 0x1400b3b7e
mov rax, qword [rsi]
cmp ecx, dword [rax - 0xc]
jg 0x1400b3b7e
mov dword [rax - 0x10], ecx
mov rax, qword [rsi]
movsxd rcx, ecx
mov word [rax + rcx*2], r15w
mov r10, qword [0x140106190]
cmp r10, rdi
je 0x1400b3b63
test byte [r10 + 0x1c], 2
je 0x1400b3b2e
cmp byte [r10 + 0x19], 4
jb 0x1400b3b2e
mov r9, qword [rsi]
mov edx, 0x4d
mov rcx, qword [r10 + 0x10]
mov r8, r13
call fcn.140003598
mov r10, qword [0x140106190]
jmp 0x1400b3b2e
lea rdi, [0x140106190]
cmp r10, rdi
je 0x1400b3b63
test byte [r10 + 0x1c], 1
je 0x1400b3b63
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400b3b63
mov rcx, qword [r10 + 0x10]
mov edx, 0x4e
mov r9d, ebx
mov r8, r13
call fcn.140003634
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.14000507c
int3