joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079941
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x14008e520
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x528]
mov rax, qword [0x1401b4078]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x1401cb146]
call fcn.14007b75f
mov edx, 0x18
lea rcx, [rbp + 8]
call fcn.14007b958
xor edx, edx
lea rcx, [rbp + 8]
call fcn.140078b40
mov rax, qword [rbp + 0x4e0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rbp + 0x4e8]
mov rax, qword [rbp + 0x4e0]
mov rdx, qword [rax]
lea rcx, [rbp + 8]
call fcn.140079e50
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
je 0x14008e647
cmp dword [rbp + 0x34], 2
je 0x14008e62a
cmp dword [rbp + 0x34], 3
je 0x14008e62a
lea rcx, [0x1401b5618]
call fcn.14007b525
mov dword [rbp + 0x4b4], eax
mov ecx, dword [0x1401b4040]
add ecx, 7
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.36.32532_atlmfcinclude_atlbase.h
lea rcx, [rbp + 0x438]
call fcn.140079527
mov ecx, dword [rbp + 0x34]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x4e8]
mov qword [rsp + 0x20], rcx
lea r9, str.CRegKey::RecurseDeleteKey_:_Failed_to_Open_Key__Ts_Error___d__n
xor r8d, r8d
mov ecx, dword [rbp + 0x4b4]
mov edx, ecx
mov rcx, rax
call fcn.1400787bc
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x464], eax
lea rcx, [rbp + 8]
call fcn.140078c3a
mov eax, dword [rbp + 0x464]
jmp 0x14008e6fa
mov dword [rbp + 0x74], 0x100
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x74]
lea r8, [rbp + 0xa0]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14008e6c9
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 8]
call fcn.140079941
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
je 0x14008e6c0
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x484], eax
lea rcx, [rbp + 8]
call fcn.140078c3a
mov eax, dword [rbp + 0x484]
jmp 0x14008e6fa
mov dword [rbp + 0x74], 0x100
jmp 0x14008e64e
lea rcx, [rbp + 8]
call fcn.14007981a
mov rdx, qword [rbp + 0x4e8]
mov rcx, qword [rbp + 0x4e0]
call fcn.140078c2b
mov dword [rbp + 0x4a4], eax
lea rcx, [rbp + 8]
call fcn.140078c3a
mov eax, dword [rbp + 0x4a4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140179920]
call fcn.14007adc3
mov rax, rdi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.140079b3f
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret
Function at 0x14007995a
Capabilities:
Query environment variable

Disassembly:
jmp 0x14013fa60
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14013f5e0
lea rcx, [rsp + 0x20]
call fcn.14013f630
movzx eax, al
test eax, eax
jne 0x14013faa5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14013f610
mov rax, qword [rsp + 0x40]
jmp 0x14013fb9f
lea rcx, [rsp + 0x20]
call fcn.14013f730
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14013f6d0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140079bc1
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14007950e
lea rcx, [rsp + 0x28]
call fcn.140079ee6
movzx eax, al
test eax, eax
jne 0x14013fb3f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14007ac38
lea rcx, [rsp + 0x20]
call fcn.14013f610
mov rax, qword [rsp + 0x50]
jmp 0x14013fb9f
lea rcx, [rsp + 0x20]
call fcn.14013f730
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14007b6d8
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140079b53
lea rcx, [rsp + 0x28]
call fcn.14007bc91
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14007ac38
lea rcx, [rsp + 0x20]
call fcn.14013f610
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x140079b12
Capabilities:
Print debug messages

Disassembly:
jmp 0x140092e70
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [0x1401b4078]
xor rax, rbp
mov qword [rbp + 0x288], rax
lea rcx, [0x1401cb150]
call fcn.14007b75f
cmp qword [rbp + 0x2c8], 0
je 0x140092eed
mov eax, dword [rbp + 0x2d8]
mov r8, qword [rbp + 0x2c8]
mov edx, eax
mov rcx, qword [rbp + 0x2d0]
call fcn.1400799eb
lea r9, [rbp + 0x2d8]
mov r8, qword [rbp + 0x2d0]
mov rdx, qword [rbp + 0x2c0]
mov rcx, qword [rbp + 0x2b8]
call fcn.14007aada
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140092f78
cmp qword [rbp + 0x2c8], 0
je 0x140092f3c
mov eax, dword [rbp + 0x2d8]
mov r8, qword [rbp + 0x2c8]
mov edx, eax
mov rcx, qword [rbp + 0x2d0]
call fcn.1400799eb
mov eax, dword [rbp + 4]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x20], rax
lea r9, str.TritonStreamATL:_Open_of__s_fail:__d.
mov r8d, 0xc7
mov edx, 0xc8
lea rcx, [rbp + 0x30]
call fcn.14007b502
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x140092f7d
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14017b850]
call fcn.14007adc3
mov rax, rdi
mov rcx, qword [rbp + 0x288]
xor rcx, rbp
call fcn.140079b3f
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret
Function at 0x140079cd9
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400bafc0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400ba940
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400bafff
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401cc020]
jmp 0x1400bb009
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x140079e69
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400baef0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400ba8c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400baf31
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401cc020]
jmp 0x1400baf37
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140079ef0
Capabilities:
Get geographical location

Disassembly:
jmp 0x1401435c0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1401424f0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140143627
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1401cc030]
jmp 0x140143649
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140079630
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140079f04
Capabilities:
Terminate process

Disassembly:
jmp 0x1400969e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14007a116
Capabilities:
Print debug messages

Disassembly:
jmp 0x140152c10
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1401b4078]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140152c36
jmp 0x140152cb3
mov rcx, qword [rbp + 0x30]
call fcn.140079923
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140152c4f
jmp 0x140152cb3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140152c6c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400789d3
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140078e3d
test eax, eax
jne 0x140152cb3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140079b3f
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x14007a12a
Capabilities:
Set registry value

Disassembly:
jmp 0x140091680
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1401cb146]
call fcn.14007b75f
mov rax, qword [rbp + 0x100]
cmp qword [rax], 0
jne 0x1400916fa
mov eax, dword [0x1401b4038]
inc eax
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x140178848]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x140178f70]
mov ecx, 2
call fcn.140078613
cmp eax, 1
jne 0x1400916fa
int3
xor eax, eax
test eax, eax
jne 0x1400916ae
cmp qword [rbp + 0x110], 0
je 0x140091716
mov dword [rbp + 0xd4], 1
jmp 0x140091720
mov dword [rbp + 0xd4], 0
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14009176f
mov eax, dword [0x1401b4038]
add eax, 2
lea rcx, str.__atl_condVal
mov qword [rsp + 0x28], rcx
lea rcx, [0x140178848]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x140178f70]
mov ecx, 2
call fcn.140078613
cmp eax, 1
jne 0x14009176f
int3
cmp dword [rbp + 4], 0
jne 0x14009177f
mov eax, 0xd
jmp 0x14009181f
xor eax, eax
test eax, eax
jne 0x140091700
cmp dword [rbp + 0x118], 1
je 0x1400917db
cmp dword [rbp + 0x118], 2
je 0x1400917db
mov eax, dword [0x1401b4038]
add eax, 3
lea rcx, str._dwType____1ul______dwType____2ul___
mov qword [rsp + 0x28], rcx
lea rcx, [0x140178848]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x140178f70]
mov ecx, 2
call fcn.140078613
cmp eax, 1
jne 0x1400917db
int3
mov rcx, qword [rbp + 0x110]
call fcn.1400783ac
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x118]
xor r8d, r8d
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14007a616
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400980e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140098100
xor al, al
jmp 0x140098181
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140098113
xor al, al
jmp 0x140098181
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14009813d
xor al, al
jmp 0x140098181
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140098151
xor al, al
jmp 0x140098181
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140098163
xor al, al
jmp 0x140098181
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14009817f
xor al, al
jmp 0x140098181
mov al, 1
add rsp, 0x38
ret
Function at 0x14007a6e8
Capabilities:
Print debug messages
Terminate process

Disassembly:
jmp 0x14008ccc0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3e8]
mov rax, qword [0x1401b4078]
xor rax, rbp
mov qword [rbp + 0x388], rax
lea rcx, [0x1401cb150]
call fcn.14007b75f
lea rcx, str.TritonStreamATL::Stop_terminate_all_created_processes
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rbp + 0x3b0]
movzx eax, word [rax + 0x292]
mov word [rbp + 4], ax
xor eax, eax
mov word [rbp + 0x24], ax
jmp 0x14008cd46
movzx eax, word [rbp + 0x24]
inc ax
mov word [rbp + 0x24], ax
movzx eax, word [rbp + 4]
inc ax
mov word [rbp + 4], ax
movzx eax, word [rbp + 0x24]
mov rcx, qword [rbp + 0x3b0]
movzx ecx, word [rcx + 0x298]
cmp eax, ecx
jge 0x14008ce3e
movzx eax, word [rbp + 0x24]
imul rax, rax, 0x18
mov rcx, qword [rbp + 0x3b0]
cmp qword [rcx + rax + 0x12e0], 0
jne 0x14008cd7c
jmp 0x14008cd30
movzx eax, word [rbp + 0x24]
imul rax, rax, 0x18
xor edx, edx
mov rcx, qword [rbp + 0x3b0]
mov rcx, qword [rcx + rax + 0x12e0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movzx eax, word [rbp + 0x24]
imul rax, rax, 0x18
mov edx, 0x3e8
mov rcx, qword [rbp + 0x3b0]
mov rcx, qword [rcx + rax + 0x12e0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x14008cdc8
jmp 0x14008cdff
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, word [rbp + 4]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r9, str.Triton:_ERR:_TerminateProcess__u__failed:__d._n
mov r8d, 0xc7
mov edx, 0xc8
lea rcx, [rbp + 0x70]
call fcn.14007b502
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx eax, word [rbp + 0x24]
imul rax, rax, 0x18
mov rcx, qword [rbp + 0x3b0]
mov rcx, qword [rcx + rax + 0x12e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [rbp + 0x24]
imul rax, rax, 0x18
mov rcx, qword [rbp + 0x3b0]
mov rcx, qword [rcx + rax + 0x12e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14008cd30
lea rcx, str.TritonStreamATL::Stop_terminate_complete
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rbp + 0x3b0]
cmp qword [rax + 0x278], 0
je 0x14008ce82
mov rax, qword [rbp + 0x3b0]
mov rcx, qword [rax + 0x278]
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rax, qword [rbp + 0x3b0]
mov qword [rax + 0x278], 0
mov rcx, qword [rbp + 0x3b0]
call fcn.1400793a6
lea rcx, [rbp - 0x30]
lea rdx, [0x14017b7d0]
call fcn.14007adc3
mov rcx, qword [rbp + 0x388]
xor rcx, rbp
call fcn.140079b3f
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret
Function at 0x14007aada
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14008e280
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x1401b4078]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1401cb146]
call fcn.14007b75f
mov rax, qword [rbp + 0x140]
cmp qword [rax], 0
jne 0x14008e325
mov eax, dword [0x1401b4030]
add eax, 5
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x140178848]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x140178f70]
mov ecx, 2
call fcn.140078613
cmp eax, 1
jne 0x14008e325
int3
xor eax, eax
test eax, eax
jne 0x14008e2d8
cmp qword [rbp + 0x158], 0
jne 0x14008e375
mov eax, dword [0x1401b4030]
add eax, 6
lea rcx, str.pnChars___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x140178848]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x140178f70]
mov ecx, 2
call fcn.140078613
cmp eax, 1
jne 0x14008e375
int3
mov rax, qword [rbp + 0x158]
mov eax, dword [rax]
shl rax, 1
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x158]
mov dword [rax], 0
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x150]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x24]
xor r8d, r8d
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x140]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14008e3d5
mov eax, dword [rbp + 4]
jmp 0x14008e461
cmp dword [rbp + 0x24], 1
je 0x14008e3e8
cmp dword [rbp + 0x24], 2
je 0x14008e3e8
mov eax, 0xd
jmp 0x14008e461
cmp qword [rbp + 0x150], 0
je 0x14008e449
cmp dword [rbp + 0x44], 0
je 0x14008e433
mov eax, dword [rbp + 0x44]
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
test rax, rax
jne 0x14008e42a
mov eax, dword [rbp + 0x44]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rbp + 0x150]
movzx eax, word [rcx + rax*2 - 2]
test eax, eax
je 0x14008e431
mov eax, 0xd
jmp 0x14008e461
jmp 0x14008e449
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rbp + 0x150]
mov word [rdx + rax], cx
mov eax, dword [rbp + 0x44]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rbp + 0x158]
mov dword [rcx], eax
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140179680]
call fcn.14007adc3
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.140079b3f
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x14007ab7a
Capabilities:
Terminate process

Disassembly:
jmp 0x14010fd20
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14010fd4e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14007b377
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14007ae4f
Capabilities:
Create service

Disassembly:
jmp 0x14008bc50
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1968
call fcn.1400789d3
sub rsp, rax
lea rbp, [rsp + 0x70]
lea rdi, [rsp + 0x70]
mov ecx, 0x4be
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1988]
mov rax, qword [0x1401b4078]
xor rax, rbp
mov qword [rbp + 0x18e8], rax
lea rcx, [0x1401cb146]
call fcn.14007b75f
mov rcx, qword [rbp + 0x1910]
call fcn.14007af6c
test eax, eax
je 0x14008bcb9
mov eax, 1
jmp 0x14008bedd
lea rax, [rbp + 0x12]
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x14008bce9
cmp dword [rbp + 0x234], 0x104
jne 0x14008bcf0
xor eax, eax
jmp 0x14008bedd
mov eax, 2
imul rax, rax, 0
mov ecx, 0x22
mov word [rbp + rax + 0x10], cx
mov eax, dword [rbp + 0x234]
inc eax
mov eax, eax
mov ecx, 0x22
mov word [rbp + rax*2 + 0x10], cx
mov eax, dword [rbp + 0x234]
add eax, 2
mov eax, eax
shl rax, 1
mov qword [rbp + 0x18d8], rax
cmp qword [rbp + 0x18d8], 0x20c
jae 0x14008bd3b
jmp 0x14008bd40
call fcn.14007a7fb
xor eax, eax
mov rcx, qword [rbp + 0x18d8]
mov word [rbp + rcx + 0x10], ax
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 0x258], rax
cmp qword [rbp + 0x258], 0
jne 0x14008bdc9
mov r8d, 0x400
lea rdx, [rbp + 0x280]
mov ecx, 0xd80a
call fcn.14007a4db
test eax, eax
jne 0x14008bda2
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rbp + 0x280]
call fcn.14007a481
mov rax, qword [rbp + 0x1910]
add rax, 0x48
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14008bedd
mov rax, qword [rbp + 0x1910]
add rax, 0x48
mov rcx, qword [rbp + 0x1910]
add rcx, 0x48
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea rdx, str.RPCSS
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov r8, rax
mov rdx, rcx
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rbp + 0xa98], rax
cmp qword [rbp + 0xa98], 0
jne 0x14008bebe
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x400
lea rdx, [rbp + 0xac0]
mov ecx, 0xd80b
call fcn.14007a4db
test eax, eax
jne 0x14008be9a
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rbp + 0xac0]
call fcn.14007a481
mov rax, qword [rbp + 0x1910]
add rax, 0x48
xor r9d, r9d
mov r8, rax
lea rdx, [rbp + 0xac0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14008bedd
mov rcx, qword [rbp + 0xa98]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x70]
lea rdx, [0x14017b230]
call fcn.14007adc3
mov rax, rdi
mov rcx, qword [rbp + 0x18e8]
xor rcx, rbp
call fcn.140079b3f
lea rsp, [rbp + 0x18f8]
pop rdi
pop rbp
ret
Function at 0x14007b09d
Capabilities:
Delete registry key

Disassembly:
jmp 0x14008e9d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x1401cb145]
call fcn.14007b75f
mov rax, qword [rbp + 0x120]
cmp qword [rax], 0
je 0x14008eabf
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14008ea62
mov eax, dword [0x1401b4014]
add eax, 4
lea rcx, str.hAdvAPI32___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x140178848]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.36.32532_atlmfcinclude_atltransactionmanager.h
mov ecx, 2
call fcn.140078613
cmp eax, 1
jne 0x14008ea62
int3
cmp qword [rbp + 8], 0
jne 0x14008ea70
mov eax, 1
jmp 0x14008eae7
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14008eabd
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x120]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x128]
call qword [rbp + 0x28]
jmp 0x14008eae7
jmp 0x14008eae2
mov rax, qword [rbp + 0x120]
cmp dword [rax + 8], 0
je 0x14008eae2
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14008eae7
mov eax, 1
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14007b3a4
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x140094010
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x1401b4078]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1401cb146]
call fcn.14007b75f
movzx eax, byte [0x1401b7d80]
test eax, eax
je 0x1400940af
xor eax, eax
test eax, eax
jne 0x1400940a8
lea rax, [0x140178840]
mov qword [rsp + 0x28], rax
lea rax, [0x140178848]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xf58
lea rdx, [0x140178f70]
mov ecx, 2
call fcn.140078613
cmp eax, 1
jne 0x1400940a8
int3
mov eax, 0xffffffff
jmp 0x140094105
mov rax, qword [rbp + 0x140]
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call fcn.140079e8c
movzx eax, al
cmp eax, 1
jne 0x1400940f6
mov edx, dword [rbp + 0x148]
mov rcx, qword [rbp + 8]
call fcn.1400781e0
mov dword [rbp + 0x24], eax
lea rcx, [0x1401b7df0]
call fcn.14007916c
mov eax, dword [rbp + 0x24]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14017ad50]
call fcn.14007adc3
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.140079b3f
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x14007b3e0
Capabilities:
Print debug messages

Disassembly:
jmp 0x14012f1f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret