joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005ea0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1400700d8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.14003adb0
lea rsi, [rsp + 0x180]
call fcn.140006100
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x30]
xor esi, esi
mov r9, rbx
mov r8d, 0x104
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
call fcn.140041304
lea rcx, [rsp + 0x30]
call qword [sym.imp.kernel32.dll_OutputDebugStringA]
test dword [0x140072d04], 0x20000
je 0x140005f50
mov rcx, qword [0x140072d10]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], esi
lea r9d, [rsi + 1]
mov r8d, edi
mov qword [rsp + 0x20], rax
lea rdx, [0x1400510a0]
call fcn.1400027e0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001bc60
add rsp, 0x150
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000afa0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov edi, 0x80008003
cmp dword [rcx + 0x30], eax
jbe 0x14000afd5
lea rdx, str.Length_of_Message_write_to_MEI_should_be_shorter_than_m_MTU
xor ecx, ecx
call fcn.140005ea0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp qword [rcx + 0x40], 0xffffffffffffffff
jne 0x14000aff7
lea rdx, str.Invalid_Device_Handle
xor ecx, ecx
call fcn.140005ea0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 0x38]
mov edx, 0x4e20
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000b028
lea rdx, str.HECI_lock_timeout
xor ecx, ecx
call fcn.140005ea0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test eax, eax
je 0x14000b050
call qword [sym.imp.kernel32.dll_GetLastError]
lea rdx, str.Failed_to_attain_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005ea0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, dword [rbx + 0x30]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x14000b0ce
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14000b0ce
call qword [sym.imp.kernel32.dll_GetLastError]
lea rdx, str.Write_file_error__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005ea0
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.kernel32.dll_ReleaseMutex]
test eax, eax
jns 0x14000b198
call qword [sym.imp.kernel32.dll_GetLastError]
lea rdx, str.Failed_to_release_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005ea0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, dword [rsp + 0x40]
lea rdx, str.message_size_write_to_MEI_is__d
xor ecx, ecx
call fcn.140005ea0
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x14000b14e
call qword [sym.imp.kernel32.dll_GetLastError]
lea rdx, str.Read_file_error__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005ea0
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.kernel32.dll_ReleaseMutex]
test eax, eax
jns 0x14000b198
call qword [sym.imp.kernel32.dll_GetLastError]
lea rdx, str.Failed_to_release_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005ea0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.kernel32.dll_ReleaseMutex]
test eax, eax
js 0x14000b0aa
mov r8d, dword [rsp + 0x40]
xor ecx, ecx
mov dword [rbx + 0x30], r8d
cmp r8d, dword [rbx + 0x10]
jbe 0x14000b18a
lea rdx, str.Length_of_Message_read_from_MEI_should_be_shorter_than_m_MTU
call fcn.140005ea0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.message_size_read_from_MEI_is__d
call fcn.140005ea0
xor edi, edi
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14000b890
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x50564150
mov rdi, rdx
mov rbx, rcx
je 0x14000b8b6
lea rdx, str.Unexpected_packet_Sig
xor ecx, ecx
call fcn.140005ea0
mov eax, 0x100
cmp word [rbx + 4], ax
je 0x14000b8cf
lea rdx, str.Unexpected_packet_Ver
xor ecx, ecx
call fcn.140005ea0
mov ecx, dword [rbx + 0x10]
lea rax, [rdi - 0x14]
cmp rcx, rax
je 0x14000b8e9
lea rdx, str.Unexpected_packet_DataLen
xor ecx, ecx
call fcn.140005ea0
mov r8d, dword [rbx + 0xc]
cmp r8d, 6
ja case.default.0x14000b909
lea rdx, [0x140000000]
mov ecx, dword [rdx + r8*4 + 0xb9b4]
add rcx, rdx
jmp rcx
lea rdx, str.Invalid_packet_status:_CHS_STATUS_MAX_MESSAGE_LENGTH_EXCEEDED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005ea0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_UNSPEC_ERROR
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005ea0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_CONN_FAILED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005ea0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_COMM_FAILED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005ea0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_NOT_CONNECTED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005ea0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_HECI_NOT_READY
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005ea0
lea rdx, str.Unsupported_packet_status___d
xor ecx, ecx
call fcn.140005ea0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000bad0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
sub rsp, 0x30
cmp byte [0x140072d20], 0
mov edi, r9d
je 0x14000baed
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x20]
lea rcx, [0x140072dd0]
call fcn.14000bf40
cmp al, 1
jne 0x14000bb4d
lea rdx, str.Start__
xor ecx, ecx
call fcn.140005ea0
lea rcx, [0x140072dd0]
call fcn.14000ca10
mov ebx, eax
test eax, eax
js 0x14000bb51
lfence
mov edx, edi
lea rcx, [0x140072dd0]
call fcn.140012270
mov ebx, eax
jmp 0x14000bb51
mov ebx, dword [rsp + 0x20]
cmp dword [0x14007305c], 0
jne 0x14000bb69
cmp byte [0x140072e32], 0
je 0x14000bb69
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000bbd0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.advapi32.dll_GetSecurityDescriptorLength]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, str.LaunchPermission
mov rcx, rdi
mov esi, eax
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x14000bc53
mov dword [rsp + 0x28], esi
lea r9d, [rax + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.LaunchPermission
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegSetValueExA]
test eax, eax
je 0x14000bc53
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000f350
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14000f409
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14000f3d5
lea rcx, str.Advapi32.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14000f3ed
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je case.default.0x14000f3ed
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call qword [case.0x14002508a.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14000f3ed
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.advapi32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp byte [0x140072dc0], 0
jne 0x14000f454
lea rcx, str.Advapi32.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f444
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x140072db8], rax
mov byte [0x140072dc0], 1
jmp 0x14000f45b
mov rax, qword [0x140072db8]
mov byte [0x140072dc0], 1
jmp 0x14000f45b
mov rax, qword [0x140072db8]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14000f3de
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x14002508a.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
invalid
jl 0x1400bf638
xchg edx, eax
stosb byte [rdi], al
movabs al, byte [0x9768b8341d6b442e]
push rdx
retf
Function at 0x14000fdf0
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x1400700d8]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.140010070
test eax, eax
je 0x14000fe21
mov eax, 1
jmp 0x14000ff28
mov r8d, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001001e
cmp eax, 0x104
je 0x14001001e
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x140010067
mov qword [rsp + 0xaa8], rbx
xor edx, edx
mov qword [rsp + 0xab0], rsi
mov r8d, 0xf003f
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor ecx, ecx
call qword [sym.imp.advapi32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000ff41
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
call fcn.14000e5a0
test eax, eax
jne 0x14000feff
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140041488
test eax, eax
je 0x14000feff
cmp eax, 0xc
je 0x14001003b
cmp eax, 0x16
je 0x140010030
cmp eax, 0x22
je 0x140010030
cmp eax, 0x50
jne 0x140010025
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.user32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14001bc60
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x58], rsi
add rdi, 0x68
mov qword [rsp + 0x50], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rsi
mov r8, rdi
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.advapi32.dll_CreateServiceW]
test rax, rax
jne 0x140010002
mov rcx, rbx
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80b
call fcn.14000e5a0
test eax, eax
jne 0x14000fff7
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140041488
test eax, eax
je 0x14000fff7
cmp eax, 0xc
je 0x14001005c
cmp eax, 0x16
je 0x140010051
cmp eax, 0x22
je 0x140010051
cmp eax, 0x50
jne 0x140010046
xor r9d, r9d
mov r8, rdi
jmp 0x14000ff06
mov rcx, rax
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14000ff18
xor eax, eax
jmp 0x14000ff28
mov ecx, 0x80004005
call fcn.14000a620
int3
mov ecx, 0x80070057
call fcn.14000a620
int3
mov ecx, 0x8007000e
call fcn.14000a620
int3
mov ecx, 0x80004005
call fcn.14000a620
int3
mov ecx, 0x80070057
call fcn.14000a620
int3
mov ecx, 0x8007000e
call fcn.14000a620
int3
call fcn.14001c2a4
int3
Function at 0x140010840
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400700d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.1400102d0
mov ebx, eax
test eax, eax
jne 0x140010957
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140010931
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140010840
mov ebx, eax
test eax, eax
jne 0x140010957
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400108e0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140010946
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.14000f350
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140010967
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14001bc60
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1400700d8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140010f05
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140010f05
call fcn.14000e570
mov ebx, eax
jmp 0x140011030
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.kernel32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140010f26
call fcn.14000e570
jmp 0x14001101f
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140010f49
call fcn.14000e570
jmp 0x14001101f
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140010f6b
mov ebx, 0x8007000e
jmp 0x140011021
mov ecx, eax
test eax, eax
je 0x140010fa3
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140011068
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140010fa3
lfence
lea rcx, [rsp + 0x60]
call fcn.14000e450
jmp 0x140010fad
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x140010fc0
cmp qword [rsp + 0x60], 0
jne 0x140010fcf
mov ebx, 0x8007000e
jmp 0x140011021
lfence
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140010ffc
call fcn.14000e570
jmp 0x14001101f
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140010990
mov ebx, eax
test rdi, rdi
je 0x140011030
mov rcx, rdi
call qword [sym.imp.kernel32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140011047
lea rcx, [rsp + 0x60]
call fcn.14000f490
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14001bc60
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
lfence
mov ecx, 0x80070216
call fcn.14000a620
int3
Function at 0x140012270
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x1400700d8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor r15d, r15d
lea r8, str.AppID
mov r14d, edx
mov qword [rsp + 0x50], r15
mov rdi, rcx
mov dword [rsp + 0x58], r15d
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x50]
mov r9d, 0x20019
call fcn.1400102d0
mov ebx, eax
test eax, eax
je 0x1400122e1
mov dword [rdi + 0x27c], eax
jmp 0x14001243e
mov rdx, qword [rsp + 0x50]
lea r8, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov r9d, 0x20019
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x48], r15
call fcn.1400102d0
mov ebx, eax
test eax, eax
jne 0x140012426
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x90]
mov dword [rsp + 0x30], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LocalService
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x140012390
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
jbe 0x140012363
lea eax, [rbx + 0xd]
jmp 0x140012390
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140012384
test al, 1
jne 0x14001237d
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], r15w
je 0x14001238d
mov eax, SafeArrayGetDim
jmp 0x140012390
mov word [rsp + 0x90], r15w
mov eax, r15d
mov dword [rdi + 0x28c], r15d
test eax, eax
jne 0x1400123ea
lea rax, [rdi + 0x68]
mov dword [rdi + 0x28c], 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
lea rax, [0x140012ef0]
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], r15
call qword [sym.imp.advapi32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x1400123e2
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rdi + 0x27c], eax
mov ebx, dword [rdi + 0x27c]
jmp 0x14001242c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x140012415
cmp eax, 0x80010106
jne 0x14001242c
lea rcx, str.Mscoree.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
jne 0x140012419
jmp 0x14001242c
mov byte [rdi + 0x62], 1
mov edx, r14d
mov rcx, rdi
call fcn.140011dc0
mov ebx, eax
mov dword [rdi + 0x27c], eax
cmp qword [rsp + 0x38], r15
je 0x14001243e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_RegCloseKey]
cmp qword [rsp + 0x50], r15
je 0x140012450
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14001bc60
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1400181b0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov r8, qword [0x140073098]
xor ecx, ecx
test r8, r8
je 0x140018209
lea rdx, str.instance_to_be_deleted:___p
mov qword [rsp + 0x20], rbx
call fcn.140005ea0
mov rbx, qword [0x140073098]
test rbx, rbx
je 0x1400181f4
mov rcx, rbx
call fcn.140016f00
mov edx, 0x88
mov rcx, rbx
call fcn.14001bbcc
mov rbx, qword [rsp + 0x20]
mov qword [0x140073098], 0
add rsp, 0x28
ret
lea rdx, str.instance_is_NULL
add rsp, 0x28
jmp fcn.140005ea0

Function at 0x14001e21c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
je 0x14001e22f
add rsp, 0x48
ret
call qword [sym.imp.kernel32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14001e848
lea rdx, [0x14006e160]
lea rcx, [rsp + 0x20]
call fcn.14003b630
int3

Function at 0x14002a27c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140073940]
xor edx, edx
jmp fcn.14001e21c

Function at 0x14002ac64
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140073940]
jmp fcn.14001e21c
Function at 0x140036b9c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140036c60]
mov r9, qword [r9 + 8]
jmp fcn.140026664

Function at 0x140036c30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140036c70]
mov r9, qword [r9 + 8]
jmp fcn.140026664
Function at 0x140047364
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400473eb
mov rsi, rbx
cmp word [rax], bp
je 0x1400473aa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140047394
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140047390
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400437ac
mov rdi, rax
test rax, rax
je 0x1400473d8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003b1a0
mov rbp, rdi
xor ecx, ecx
call fcn.140043e44
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400487e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1388]
mov eax, 0x1460
call fcn.14001c450
sub rsp, rax
mov rax, qword [0x1400700d8]
xor rax, rsp
mov qword [rbp + 0x1350], rax
and dword [rsp + 0x38], 0
xor r15d, r15d
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov r12d, r9d
sar rax, 6
lea rcx, [0x140073ed0]
and r10d, 0x3f
mov dword [rsp + 0x3c], r15d
add r12, r8
xor r14d, r14d
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r13, qword [rax + rdx*8 + 0x28]
cmp r8, r12
jae 0x1400488d5
lea rbx, [rsp + 0x50]
cmp rsi, r12
jae 0x14004888d
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x14004887c
inc r14d
mov byte [rbx], SafeArrayDestroy
inc rbx
mov byte [rbx], al
inc rbx
lea rax, [rbp + 0x134f]
cmp rbx, rax
jb 0x140048865
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x50]
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x1400488cb
add r15d, dword [rsp + 0x30]
mov dword [rsp + 0x3c], r15d
cmp dword [rsp + 0x30], ebx
jb 0x1400488d5
cmp rsi, r12
jb 0x140048860
jmp 0x1400488d5
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsp + 0x38], eax
movsd xmm0, qword [rsp + 0x38]
mov rax, rdi
movsd qword [rdi], xmm0
mov dword [rdi + 8], r14d
mov rcx, qword [rbp + 0x1350]
xor rcx, rsp
call fcn.14001bc60
lea r11, [rsp + 0x1460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret