joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000798c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x58], 0
lea rax, [rbp + 0x58]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareGoogleUpdateDev_
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007a24
and dword [rbp + 0x48], eax
lea esi, [rax + 4]
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x40]
lea rax, [rbp + 0x48]
mov dword [rbp + 0x50], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.IsEnabledLogToFile
mov dword [rbp + 0x40], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140007a24
cmp dword [rbp + 0x40], esi
jne 0x140007a24
cmp dword [rbp + 0x48], ebx
je 0x140007a24
mov al, 1
jmp 0x140007a26
xor al, al
lea rdx, [rbp - 0x10]
mov byte [rdi + 0x93], al
mov rcx, rdi
call fcn.140008964
mov rbx, qword [rbp - 0x10]
cmp dword [rbx - 0x10], 0
je 0x140007ad6
lea rsi, str.LoggingSettings
mov r9, rbx
mov rcx, rsi
lea rdx, str.EnableLogging
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r9, rbx
lea rdx, str.ShowTime
test eax, eax
mov r8d, 1
mov rcx, rsi
setne al
mov byte [rdi + 0x90], al
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r9, rbx
lea rdx, str.LogToOutputDebug
test eax, eax
mov rcx, rsi
setne al
xor r8d, r8d
mov byte [rdi + 0x92], al
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r9, rbx
lea rdx, str.AppendToFile
test eax, eax
mov r8d, 1
mov rcx, rsi
setne al
mov byte [rdi + 0x94], al
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne al
jmp 0x140007aed
mov byte [rdi + 0x90], 1
mov al, 1
mov byte [rdi + 0x92], 1
mov byte [rdi + 0x94], 0
mov byte [rdi + 0x95], al
cmp byte [rdi + 0x91], 0
je 0x140007b03
mov byte [rdi + 0x92], 1
mov byte [rdi], 1
lea rax, str.LC_UTIL
mov dword [rdi + 4], 7
xor esi, esi
mov r15, qword [rsi + rax]
test r15, r15
je 0x140007b8f
movsxd r12, dword [rsi + rax + 8]
cmp r12d, 9
ja 0x140007b8f
lea rdx, [rbp - 8]
mov rcx, rdi
mov r14d, 1
call fcn.140008964
mov rbx, qword [rbp - 8]
cmp dword [rbx - 0x10], 0
je 0x140007b5f
mov r9, rbx
lea rcx, str.LoggingLevel
mov r8d, r14d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r14d, eax
test r14d, r14d
mov dword [rdi + r12*8 + 4], r14d
lea rdx, [rbx - 0x18]
setne cl
or eax, 0xffffffff
mov byte [rdi + r12*8], cl
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007b88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, str.LC_UTIL
add rsi, 0x10
cmp rsi, 0x90
jb 0x140007b16
call fcn.140007434
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov qword [rdi + 0x98], rax
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007bca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140007bdc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, rdx
call fcn.14000144c
xor r14d, r14d
test rax, rax
je 0x140007ddb
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0x18]
lea ebp, [r14 + 1]
mov ecx, ebp
lea rbx, [rax + 0x18]
mov eax, dword [rbx - 0xc]
sub ecx, dword [rbx - 8]
sub eax, 0x104
or ecx, eax
mov qword [rsp + 0x60], rbx
jge 0x140007c3e
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140001a54
mov rbx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x140007c6c
lea rcx, [rsp + 0x50]
lea rdx, [0x14004b748]
call fcn.1400052a0
jmp 0x140007c8f
lea rdx, str.GoogleUpdateLog
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
test eax, eax
je 0x140007c5e
lea rdx, [rsp + 0x60]
call fcn.14000532c
test rbx, rbx
jne 0x140007c99
mov eax, r14d
jmp 0x140007cad
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140031f70
test eax, eax
js 0x140007dd0
cmp eax, dword [rbx - 0xc]
jg 0x140007dd0
mov dword [rbx - 0x10], eax
lea rdx, [rbx - 0x18]
cdqe
mov word [rbx + rax*2], r14w
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, ebp
jg 0x140007cd9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0x10], r14d
jne 0x140007d15
call fcn.14000144c
test rax, rax
je 0x140007ddb
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [rbx - 0x18]
mov qword [rsi], rax
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, ebp
jmp 0x140007da5
mov eax, dword [rbx - 0xc]
sub ebp, dword [rbx - 8]
sub eax, 0x104
or ebp, eax
jge 0x140007d38
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140001a54
mov rbx, qword [rsp + 0x50]
lea rdx, str.GoogleUpdate.log
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
sete bpl
test rbx, rbx
jne 0x140007d58
mov eax, r14d
jmp 0x140007d68
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140031f70
test eax, eax
js 0x140007dd0
cmp eax, dword [rbx - 0xc]
jg 0x140007dd0
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
test bpl, bpl
je 0x140007dc1
call fcn.14000144c
test rax, rax
je 0x140007ddb
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007db0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14000532c
jmp 0x140007d96
mov ecx, 0x80070057
call fcn.1400017a4
int3
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x140007de8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [rcx + 0x93], 0
mov r14, rcx
je 0x140007f69
cmp qword [rcx + 0x128], 0
jne 0x140007f42
lea rdx, [rbp - 0x40]
call fcn.140007bdc
mov rbx, qword [rbp - 0x40]
or esi, 0xffffffff
cmp dword [rbx - 0x10], 0
je 0x140007e9d
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x38]
call fcn.14000c4ac
mov rdi, qword [rbp - 0x38]
lea r8, [rbp - 0x30]
xorps xmm0, xmm0
xor eax, eax
mov rcx, rdi
mov dword [rbp - 0x10], eax
xor edx, edx
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x140007ec0
mov rcx, rdi
call fcn.140006484
test eax, eax
jns 0x140007ec0
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140007e99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x40]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140007f69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140007f69
mov sil, byte [r14 + 0x95]
mov ecx, 0x38
call fcn.140039864
mov r8b, sil
mov rdx, rbx
mov rcx, rax
call fcn.140008a18
mov qword [r14 + 0x128], rax
test rax, rax
jne 0x140007f07
mov rdx, qword [r14 + 0x58]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_log_writer_to__s
mov r8, rbx
call fcn.14000c980
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or esi, 0xffffffff
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140007f24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x40]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140007f42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [r14 + 0x128]
test rcx, rcx
je 0x140007f69
movsxd rax, dword [r14 + 0xa8]
cmp eax, 0xf
jge 0x140007f69
mov qword [r14 + rax*8 + 0xb0], rcx
inc dword [r14 + 0xa8]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140021680
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140007f8c
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x138], 0
mov rbx, rcx
jne 0x140007fd6
mov ecx, 0x40
call fcn.140039864
mov rcx, rax
call fcn.14000cbac
mov qword [rbx + 0x138], rax
test rax, rax
jne 0x140007fd6
mov rdx, qword [rbx + 0x58]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_ETW_log_writer
call fcn.14000c980
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbx + 0x138]
test rcx, rcx
je 0x140007ffc
movsxd rax, dword [rbx + 0xa8]
cmp eax, 0xf
jge 0x140007ffc
mov qword [rbx + rax*8 + 0xb0], rcx
inc dword [rbx + 0xa8]
mov rcx, rbx
call fcn.140007de8
cmp byte [rbx + 0x94], 0
je 0x140008056
mov rcx, qword [rbx + 0x130]
test rcx, rcx
jne 0x14000803c
mov ecx, 8
call fcn.140039864
mov rcx, rax
lea rax, fcn.140002460
mov qword [rcx], rax
mov qword [rbx + 0x130], rcx
test rcx, rcx
je 0x140008056
movsxd rax, dword [rbx + 0xa8]
cmp eax, 0xf
jge 0x140008056
mov qword [rbx + rax*8 + 0xb0], rcx
inc dword [rbx + 0xa8]
cmp dword [rbx + 0xa8], 0
setg al
add rsp, 0x20
pop rbx
ret

Function at 0x140008068
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp byte [rcx + 0x96], 1
jne 0x1400080ae
lea rcx, [rsp + 0x48]
call fcn.1400075dc
mov rdx, qword [rax]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Calling_the_logging_system_after_it_has_been_shut_down__n
call fcn.14000c980
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x48]
call fcn.1400018b0
xor al, al
jmp 0x1400080ff
cmp byte [rcx + 0x50], 1
jne 0x1400080b8
mov al, 1
jmp 0x1400080ff
cmp byte [rcx + 0x51], 0
je 0x1400080c2
xor al, al
jmp 0x1400080ff
mov byte [rcx + 0x51], 1
call fcn.14000798c
cmp byte [rbx + 0x90], 0
je 0x1400080df
mov rcx, rbx
call fcn.140007f8c
mov byte [rbx + 0x50], al
mov byte [rbx + 0x51], 0
mov al, 1
jmp 0x1400080ff
add rsp, 0x30
pop rbx
ret

Function at 0x140008108
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov al, 1
mov rbx, rcx
cmp byte [rcx + 0x96], al
jne 0x140008164
lea rcx, [rsp + 0x30]
call fcn.1400075dc
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Calling_the_logging_system_after_it_has_been_shut_down__n
mov rdx, qword [rax]
call fcn.14000c980
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008160
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x14000818b
cmp byte [rcx + 0x50], al
je 0x14000818b
lea rdi, [rcx + 0x60]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov rcx, rbx
call fcn.140008068
mov rdx, qword [rdi]
mov rcx, rdi
mov bl, al
call qword [rdx + 0x10]
mov al, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140008600
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rsi, qword [rsp + 0xa0]
mov ebp, r9d
mov r12d, r8d
mov r14d, edx
mov r13, rcx
test rsi, rsi
je 0x140008764
test edx, edx
jne 0x140008647
cmp r9d, 2
jg 0x140008764
call fcn.14000144c
test rax, rax
je 0x140008782
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.14000144c
test rax, rax
je 0x140008782
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov edi, 1
lea r15, [r13 + 0x60]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xa0], rbx
xor edx, edx
mov rcx, r15
call fcn.14000a950
test al, al
jne 0x1400086b5
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x14
jle 0x140008693
jmp 0x140008700
mov rax, qword [rsp + 0xa8]
mov r9d, ebp
mov qword [rsp + 0x38], rax
mov r8d, r12d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov edx, r14d
lea rax, [rsp + 0x40]
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.140008378
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
mov rbx, qword [rsp + 0xa0]
cmp edi, 0x14
jle 0x140008728
lea rcx, str.LOG_SYSTEM:_Couldnt_acquire_lock__
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x14004ede8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140008745
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140008764
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x140008a18
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and word [rcx + 0xc], 0
lea rax, fcn.140008c14
mov ebp, 1
mov qword [rcx], rax
mov byte [rcx + 0xf], bpl
mov rbx, rdx
mov rdi, rcx
mov dword [rcx + 8], 0x989680
mov byte [rcx + 0xe], r8b
call fcn.14000144c
test rax, rax
je 0x140008b64
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rcx, [rdi + 0x20]
mov rdx, rbx
add rax, 0x18
mov qword [rdi + 0x10], rax
and qword [rdi + 0x18], 0
call fcn.1400052a0
and qword [rdi + 0x28], 0
call fcn.14000144c
test rax, rax
je 0x140008b64
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rcx, [0x140059d40]
mov qword [rdi + 0x30], rax
mov al, byte [0x140059d39]
neg al
sbb rsi, rsi
and rsi, rcx
je 0x140008b4e
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140008964
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], 0
je 0x140008b1c
mov r9, rbx
lea rdx, str.MaxLogFileSize
mov r8d, 0x989680
lea rcx, str.LoggingSettings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r9, rbx
lea rdx, str.LogFileWide
lea rcx, str.LoggingSettings
mov dword [rdi + 8], eax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne bpl
jmp 0x140008b23
mov dword [rdi + 8], 0x989680
lea rdx, [rsi + 0x58]
mov byte [rdi + 0xf], bpl
lea rcx, [rdi + 0x30]
call fcn.1400017c8
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008b4e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x140008c4c
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, rcx
lea r8, [rcx + 0x20]
lea rcx, [rbp + 0x50]
lea rdx, str._Google_Update_logging_mutex_
call fcn.140009758
or r12d, 0xffffffff
mov r14, rax
xor edi, edi
mov r9, qword [rax]
mov rdx, r9
movzx r8d, word [r9]
jmp 0x140008c99
cmp r8w, 0x5c
je 0x140008cb8
add rdx, 2
movzx r8d, word [rdx]
test r8w, r8w
jne 0x140008c8a
mov edx, r12d
cmp edx, r12d
jne 0x140008cc0
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.14000532c
jmp 0x140008d4c
sub rdx, r9
sar rdx, 1
jmp 0x140008ca2
call fcn.14000144c
mov rcx, rax
test rax, rax
je 0x140008e63
mov rax, qword [rax]
call qword [rax + 0x18]
mov esi, edi
lea rbx, [rax + 0x18]
mov rax, qword [r14]
mov qword [rbp + 0x40], rbx
cmp dword [rax - 0x10], edi
jle 0x140008d23
mov rbx, rdi
test rbx, rbx
js 0x140008e58
cmp esi, dword [rax - 0x10]
jg 0x140008e58
movzx edx, word [rbx + rax]
cmp dx, 0x5c
je 0x140008d14
lea rcx, [rbp + 0x40]
call fcn.14000542c
mov rax, qword [r14]
inc esi
add rbx, 2
cmp esi, dword [rax - 0x10]
jl 0x140008cec
mov rbx, qword [rbp + 0x40]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.14000532c
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140008d4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rbp + 0x48]
lea rcx, [r15 + 0x10]
call fcn.1400017c8
mov rdx, qword [rbp + 0x48]
mov eax, r12d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140008d79
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x50]
mov eax, r12d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140008d99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rsi, [0x14004e3c8]
mov qword [rbp - 0x38], rdi
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rsi
call fcn.1400043f4
mov rdx, qword [rbp - 0x38]
mov rax, rdi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rax
test rdx, rdx
je 0x140008dd2
lea rcx, [rbp - 0x18]
call fcn.140003948
mov rax, qword [rbp - 0x10]
mov rbx, qword [r15 + 0x10]
mov dword [rbp - 0x30], 0x18
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], edi
call fcn.14000a740
mov rax, qword [0x140059a60]
lea rcx, [rbp - 0x30]
test rax, rax
je 0x140008e09
mov r9d, 0x100001
xor r8d, r8d
mov rdx, rbx
call rax
jmp 0x140008e14
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [r15 + 0x18], rax
test rax, rax
je 0x140008e2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete dil
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x18], rsi
call fcn.140003870
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rsi
call fcn.140003870
mov al, dil
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400017a4
int3
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x140009108
Capabilities:
Move file
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.LOG_SYSTEM:_trying_to_move_log_file_to_backup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdi, [rsi + 0x20]
mov rdx, rdi
lea r8, str..bak
lea rcx, [rsp + 0x30]
call fcn.14000627c
mov rbx, qword [rsp + 0x30]
mov r8d, 0xb
mov rcx, qword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140009161
call fcn.14000c81c
jmp 0x140009163
xor eax, eax
test eax, eax
jns 0x140009190
lea rcx, str.LOG_SYSTEM:_failed_to_move_log_file_to_backup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rsi
call fcn.1400091c4
test al, al
jne 0x14000918b
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.140006808
xor dil, dil
jmp 0x140009193
mov dil, 1
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400091ae
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rbx, qword [rsp + 0x38]
mov al, dil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400091c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp + 0x27], rax
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetControlSession_Manager]
lea rdx, [rbp - 0x49]
movaps xmm1, xmmword [0x14004f120]
mov rdi, rcx
movzx eax, word [0x14004f170]
xor r12d, r12d
movaps xmmword [rbp - 0x49], xmm0
mov r9d, 0x20019
movaps xmm0, xmmword [0x14004f130]
xor r8d, r8d
movaps xmmword [rbp - 0x39], xmm1
mov rcx, 0xffffffff80000002
movaps xmm1, xmmword [0x14004f140]
movaps xmmword [rbp - 0x29], xmm0
movaps xmm0, xmmword [0x14004f150]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [0x14004f160]
mov word [rbp + 0x17], ax
lea rax, [rbp - 0x61]
movaps xmmword [rbp - 9], xmm0
movaps xmmword [rbp + 7], xmm1
mov qword [rbp - 0x61], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400093b1
mov rcx, qword [rbp - 0x61]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x65]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, str.PendingFileRenameOperations
mov dword [rbp - 0x69], r12d
mov dword [rbp - 0x65], 7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400093b1
cmp dword [rbp - 0x65], 7
jne 0x1400093b1
mov ecx, dword [rbp - 0x69]
call fcn.1400398c0
mov r8d, dword [rbp - 0x69]
xor edx, edx
mov rcx, rax
mov qword [rbp - 0x59], rax
mov rbx, rax
call fcn.140022290
mov rcx, qword [rbp - 0x61]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea rdx, str.PendingFileRenameOperations
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000939c
mov esi, dword [rbp - 0x69]
shr rsi, 1
lea rax, [rsi - 2]
cmp rax, 0xffffd
ja 0x14000939c
cmp word [rbx + rsi*2 - 4], r12w
jne 0x14000939c
cmp word [rbx + rsi*2 - 2], r12w
jne 0x14000939c
lea r8, [rdi + 0x20]
lea rdx, str.___
lea rcx, [rbp - 0x51]
call fcn.140009758
mov rdi, qword [rbp - 0x51]
mov r14d, r12d
test rsi, rsi
je 0x140009370
lea r15, [rbx + r14*2]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140009374
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
inc rcx
add r14, rcx
cmp r14, rsi
jb 0x140009345
or r14d, 0xffffffff
cmp r14d, 0xffffffff
lea rdx, [rdi - 0x18]
setne sil
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009396
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x59]
jmp 0x14000939f
mov sil, r12b
test rbx, rbx
je 0x1400093ac
mov rcx, rbx
call fcn.14002192c
mov al, sil
jmp 0x1400093b3
xor al, al
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140021680
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400096dc
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x1400096f2
xor al, al
jmp 0x140009729
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x140009727
mov r8, qword [rbx + 0x10]
lea rcx, str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
mov rdx, qword [rbx + 0x30]
call fcn.14000c980
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [rbx + 0xd], 0
jmp 0x1400096ee
mov al, 1
add rsp, 0x20
pop rbx
ret