joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x14016d608]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r14, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140002691
call fcn.140001b40
mov ebx, eax
jmp 0x1400027e2
xor r9d, r9d
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rdi, rax
test rax, rax
jne 0x1400026b5
call fcn.140001b40
jmp 0x1400027d6
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400026ab
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x140002707
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400026fd
lea rcx, [rsp + 0x70]
call fcn.1400047a8
nop
mov eax, 0x8007000e
jmp 0x140002808
mov r14d, eax
test eax, eax
jne 0x140002713
mov r14, rbx
jmp 0x140002729
xor edx, edx
or rax, 0xffffffffffffffff
div r14
cmp rax, 2
jb 0x1400027fd
add r14, r14
cmp qword [rsp + 0x70], rbx
je 0x140002748
lea r8, str.m_p__0
mov edx, 0x207
lea rcx, str.sdkinc_atlmfc_atlalloc.h
call fcn.140081b60
cmp r14, 0x400
jbe 0x140002765
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.14000489c
mov rax, qword [rsp + 0x70]
jmp 0x14000276f
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140002786
test rax, rax
jne 0x140002792
mov ebx, 0x8007000e
jmp 0x1400027d8
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1400026ab
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400033bc
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400027f9
lea rcx, [rsp + 0x70]
call fcn.1400047a8
nop
mov eax, ebx
jmp 0x140002808
mov ecx, 0x80070057
call fcn.140001ae4
nop
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14013cc00
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140023358
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rbx, rcx
mov rcx, qword [0x14016d090]
lea r15, [0x14016d090]
cmp rcx, r15
je 0x1400233aa
test byte [rcx + 0x1c], 1
je 0x1400233aa
cmp byte [rcx + 0x19], 4
jb 0x1400233aa
mov rcx, qword [rcx + 0x10]
lea r8, [0x140147170]
mov edx, 0x1f7
call fcn.140004968
and qword [rsp + 0x60], 0
test r14, r14
jne 0x1400233cd
lea r8, str.pbExist
mov edx, 0x2e75
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
test rbx, rbx
jne 0x1400233ea
lea r8, str.wszSnapshotName
mov edx, 0x2e76
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
lea rdx, [rsp + 0x60]
mov byte [r14], 1
mov rcx, rbx
call fcn.1400827b0
mov rbx, qword [rsp + 0x60]
mov esi, eax
test eax, eax
js 0x14002355b
xor edi, edi
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400234b4
lea r15d, [rdi + 1]
cmp r15d, 5
jae 0x14002349b
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140023483
test byte [rcx + 0x1c], 1
je 0x140023483
cmp byte [rcx + 0x19], 4
jb 0x140023483
mov rcx, qword [rcx + 0x10]
lea r8, [0x140147170]
mov edx, 0x1fa
mov qword [rsp + 0x20], rbx
mov r9d, edi
call fcn.14000f75c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
or rbp, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, r15d
cmp r15d, 5
jb 0x14002340c
lea r15, [0x14016d090]
jmp 0x14002354c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140023503
mov rcx, qword [0x14016d090]
lea r15, [0x14016d090]
cmp rcx, r15
je 0x1400234fd
test byte [rcx + 0x1c], 1
je 0x1400234fd
cmp byte [rcx + 0x19], 4
jb 0x1400234fd
mov rcx, qword [rcx + 0x10]
lea r8, [0x140147170]
mov edx, 0x1f8
mov r9, rbx
call fcn.140005868
mov rcx, qword [0x14016d090]
mov byte [r14], 0
jmp 0x140023562
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov rcx, qword [0x14016d090]
lea r15, [0x14016d090]
cmp rcx, r15
je 0x140023562
test byte [rcx + 0x1c], 1
je 0x140023562
cmp byte [rcx + 0x19], 2
jb 0x140023562
mov rcx, qword [rcx + 0x10]
lea r8, [0x140147170]
mov edx, 0x1f9
mov dword [rsp + 0x20], esi
mov r9, rbx
call fcn.1400058c8
cmp rbp, 0xffffffffffffffff
je 0x14002355b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14016d090]
test rbx, rbx
je 0x140023577
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x14002359d
test byte [rcx + 0x1c], 1
je 0x14002359d
cmp byte [rcx + 0x19], 4
jb 0x14002359d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140147170]
mov edx, 0x1fb
call fcn.140004968
mov rbx, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14002c5fc
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r15
sub rsp, 0x260
mov rax, qword [0x14016d608]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ebp, ebp
mov rbx, rcx
mov qword [rsp + 0x30], rbp
mov rcx, qword [0x14016d090]
lea r15, [0x14016d090]
lea r12, [0x140147170]
cmp rcx, r15
je 0x14002c665
test byte [rcx + 0x1c], 1
je 0x14002c665
cmp byte [rcx + 0x19], 4
jb 0x14002c665
mov rcx, qword [rcx + 0x10]
mov edx, 0x2c5
mov r8, r12
call fcn.140004968
mov edx, dword [rbx + 0x150]
lea r8, [rsp + 0x30]
mov rcx, qword [rbx + 0x158]
call fcn.140104a90
mov edi, eax
test eax, eax
jns 0x14002c6c7
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x14002c7b8
test byte [rcx + 0x1c], 1
je 0x14002c7b8
cmp byte [rcx + 0x19], 2
jb 0x14002c7b8
mov r9, qword [rbx + 0x158]
mov edx, 0x2c6
mov rcx, qword [rcx + 0x10]
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.1400058c8
jmp 0x14002c7b1
mov edi, 0x101
lea rcx, [rsp + 0x40]
mov r8d, edi
mov dword [rsp + 0x38], edi
xor edx, edx
call sub.msvcrt.dll_memset
mov r8, qword [rbx + 0x260]
lea rcx, [rsp + 0x40]
test r8, r8
jne 0x14002c746
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x14002c74e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x14002c73f
test byte [rcx + 0x1c], 1
je 0x14002c73f
cmp byte [rcx + 0x19], 2
jb 0x14002c73f
mov rcx, qword [rcx + 0x10]
mov edx, 0x2c7
movzx r9d, ax
mov r8, r12
or r9d, 0x80070000
test eax, eax
cmovle r9d, eax
call fcn.140004988
mov word [rsp + 0x40], bp
jmp 0x14002c74e
mov rdx, rdi
call fcn.140039a84
mov r8, qword [rbx + 0x188]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx + 0x158]
mov rcx, qword [rsp + 0x30]
call fcn.1400d662c
mov edi, eax
test eax, eax
jns 0x14002c7b1
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x14002c7b8
test byte [rcx + 0x1c], 1
je 0x14002c7b8
cmp byte [rcx + 0x19], 2
jb 0x14002c7b8
mov r9, qword [rbx + 0x158]
mov edx, 0x2c8
mov rcx, qword [rcx + 0x10]
mov r8, r12
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x160]
mov qword [rsp + 0x20], rax
call fcn.1400059f4
mov rcx, qword [0x14016d090]
cmp qword [rsp + 0x30], rbp
je 0x14002c7d1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14016d090]
cmp rcx, r15
je 0x14002c7f3
test byte [rcx + 0x1c], 1
je 0x14002c7f3
cmp byte [rcx + 0x19], 4
jb 0x14002c7f3
mov rcx, qword [rcx + 0x10]
mov edx, 0x2c9
mov r8, r12
call fcn.140004968
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14013cc00
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
Function at 0x14004a488
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x20]
mov dword [rsp + 0x58], 4
mov qword [r11 - 0x10], rax
mov rsi, r8
mov qword [r11 - 0x18], r8
xor r9d, r9d
xor r8d, r8d
mov rdi, rdx
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004a53f
cmp dword [rsi], ebx
je 0x14004a4fa
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x14004a5b3
test byte [rcx + 0x1c], 1
je 0x14004a5b3
cmp byte [rcx + 0x19], 4
jb 0x14004a5b3
mov edx, 0x213
jmp 0x14004a52a
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x14004a5b3
test byte [rcx + 0x1c], 1
je 0x14004a5b3
cmp byte [rcx + 0x19], 4
jb 0x14004a5b3
mov edx, 0x214
mov rcx, qword [rcx + 0x10]
lea r8, [0x140147af8]
mov r9, rdi
call fcn.140005868
jmp 0x14004a5b3
cmp eax, 2
jne 0x14004a56a
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x14004a5b3
test byte [rcx + 0x1c], 1
je 0x14004a5b3
cmp byte [rcx + 0x19], 3
jb 0x14004a5b3
mov edx, 0x215
jmp 0x14004a52a
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x14004a5b3
test byte [rcx + 0x1c], 1
je 0x14004a5b3
cmp byte [rcx + 0x19], 2
jb 0x14004a5b3
mov rcx, qword [rcx + 0x10]
lea r8, [0x140147af8]
mov edx, 0x216
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1400058c8
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14005d790
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
cmp byte [0x14016e2a9], 0
mov qword [0x14016e2b0], rcx
je 0x14005d7c1
lea r8, [0x1401448dc]
mov edx, 0xe3f
lea rcx, str.sdkinc_atlmfc_atlbase.h
call fcn.140081b60
or eax, 0xffffffff
jmp 0x14005d7ea
and dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x30]
call fcn.14005dba0
cmp al, 1
jne 0x14005d7e6
add rsp, 0x28
jmp 0x14005de3c
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], r14
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14016d608]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r14d, r14d
lea r8, str.AppID
mov r9d, 0x20019
mov qword [rsp + 0x50], r14
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], r14
call fcn.140001d24
mov ebx, eax
test eax, eax
je 0x14005dea8
mov dword [0x14016e5fc], eax
jmp 0x14005dfe4
mov rdx, qword [rsp + 0x50]
lea r8, [0x140147ff0]
mov r9d, 0x20019
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
call fcn.140001d24
mov ebx, eax
test eax, eax
jne 0x14005dfcc
cmp qword [rsp + 0x38], r14
jne 0x14005defc
lea r8, str.m_hKey___0
mov edx, 0x15eb
lea rcx, str.sdkinc_atlmfc_atlbase.h
call fcn.140081b60
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x30], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LocalService
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov edx, 1
test eax, eax
jne 0x14005df6c
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, edx
jbe 0x14005df4b
mov eax, r14d
jmp 0x14005df74
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14005df64
test dl, al
jne 0x14005df46
shr rax, 1
cmp word [rbp + rax*2 - 0x72], r14w
je 0x14005df69
jmp 0x14005df46
mov word [rbp - 0x70], r14w
mov ecx, r14d
test ecx, ecx
mov eax, r14d
cmove eax, edx
mov dword [0x14016e60c], eax
test eax, eax
je 0x14005dfbe
lea rax, [0x14016e3e8]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
lea rax, [0x14005e0f0]
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x70], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14005dfb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14005dfca
mov ebx, dword [0x14016e5fc]
jmp 0x14005dfd2
lea rcx, [0x14016e380]
call fcn.14005d298
mov ebx, eax
mov dword [0x14016e5fc], eax
cmp qword [rsp + 0x38], r14
je 0x14005dfe4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x50], r14
je 0x14005dff6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14013cc00
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov r14, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14005d998
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x14016e6e0]
mov rsi, rcx
mov rax, qword [0x14016e6e8]
mov ebx, 1
jmp 0x14005da4a
test ebx, ebx
js 0x14005db8d
mov r14, qword [rdi]
test r14, r14
je 0x14005da46
and qword [rsp + 0x50], 0
cmp qword [r14 + 0x10], 0
jne 0x14005d9e5
xor ebx, ebx
jmp 0x14005da46
mov rcx, qword [r14 + 0x18]
lea r8, [rsp + 0x50]
mov rax, qword [r14 + 0x10]
lea rdx, [0x140148338]
call qword [case.0x140005783.0]
mov ebx, eax
test eax, eax
js 0x14005da28
mov rdx, qword [rsp + 0x50]
lea rax, [r14 + 0x28]
mov rcx, qword [r14]
mov r9d, 5
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 1]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14005da3f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005783.0]
mov rax, qword [0x14016e6e8]
add rdi, 8
cmp rdi, rax
jb 0x14005d9c4
test ebx, ebx
js 0x14005db8d
lea r14, str.___HRESULT__hr_____0_
jne 0x14005db71
cmp byte [rsi + 0x60], 0
je 0x14005db0f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x50], rax
test rax, rax
je 0x14005db08
lea rax, [rsp + 0x58]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14005e2b0]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x14005dac0
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14005db08
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test eax, eax
jns 0x14005dafd
mov r8, r14
lea rcx, str.sdkinc_atlmfc_atlbase.h
mov edx, 0xdba
call fcn.140081b60
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [rsi + 0x58]
mov rcx, rdi
add edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005db2f
mov ebx, 0x80004005
jmp 0x14005db33
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test eax, eax
jns 0x14005db8d
mov r8, r14
lea rcx, str.sdkinc_atlmfc_atlbase.h
mov edx, 0xdc5
call fcn.140081b60
test ebx, ebx
jns 0x14005db8d
mov rdi, qword [0x14016e6e0]
xor eax, eax
mov rcx, qword [0x14016e6e8]
jmp 0x14005db6a
test eax, eax
jne 0x14005db75
mov rdx, qword [rdi]
test rdx, rdx
je 0x14005db66
cmp dword [rdx + 0x28], eax
je 0x14005db66
mov ecx, dword [rdx + 0x28]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rcx, qword [0x14016e6e8]
add rdi, 8
cmp rdi, rcx
jb 0x14005db45
jmp 0x14005db75
mov byte [rsi + 0x60], 0
test ebx, ebx
jns 0x14005db8d
mov r8, r14
lea rcx, str.sdkinc_atlmfc_atlbase.h
mov edx, 0xde5
call fcn.140081b60
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14005de3c
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
cmp byte [0x14016e2a9], 0
mov qword [0x14016e2b0], rcx
je 0x14005d7c1
lea r8, [0x1401448dc]
mov edx, 0xe3f
lea rcx, str.sdkinc_atlmfc_atlbase.h
call fcn.140081b60
or eax, 0xffffffff
jmp 0x14005d7ea
and dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x30]
call fcn.14005dba0
cmp al, 1
jne 0x14005d7e6
add rsp, 0x28
jmp 0x14005de3c
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], r14
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14016d608]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r14d, r14d
lea r8, str.AppID
mov r9d, 0x20019
mov qword [rsp + 0x50], r14
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], r14
call fcn.140001d24
mov ebx, eax
test eax, eax
je 0x14005dea8
mov dword [0x14016e5fc], eax
jmp 0x14005dfe4
mov rdx, qword [rsp + 0x50]
lea r8, [0x140147ff0]
mov r9d, 0x20019
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
call fcn.140001d24
mov ebx, eax
test eax, eax
jne 0x14005dfcc
cmp qword [rsp + 0x38], r14
jne 0x14005defc
lea r8, str.m_hKey___0
mov edx, 0x15eb
lea rcx, str.sdkinc_atlmfc_atlbase.h
call fcn.140081b60
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x30], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LocalService
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov edx, 1
test eax, eax
jne 0x14005df6c
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, edx
jbe 0x14005df4b
mov eax, r14d
jmp 0x14005df74
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14005df64
test dl, al
jne 0x14005df46
shr rax, 1
cmp word [rbp + rax*2 - 0x72], r14w
je 0x14005df69
jmp 0x14005df46
mov word [rbp - 0x70], r14w
mov ecx, r14d
test ecx, ecx
mov eax, r14d
cmove eax, edx
mov dword [0x14016e60c], eax
test eax, eax
je 0x14005dfbe
lea rax, [0x14016e3e8]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
lea rax, [0x14005e0f0]
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x70], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14005dfb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14005dfca
mov ebx, dword [0x14016e5fc]
jmp 0x14005dfd2
lea rcx, [0x14016e380]
call fcn.14005d298
mov ebx, eax
mov dword [0x14016e5fc], eax
cmp qword [rsp + 0x38], r14
je 0x14005dfe4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0x50], r14
je 0x14005dff6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14013cc00
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov r14, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14005e0f8
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov r14b, dl
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14005e16d
lea r8d, [rdi + 1]
mov rcx, rax
lea rdx, [0x14016e3e8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14005e156
mov rcx, rax
mov edi, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x14005e16d
mov eax, 0x80004005
jmp 0x14005e291
mov edx, 0x67
lea rax, str.APPID
xorps xmm0, xmm0
mov qword [rbp - 0x28], rax
lea rbx, [0x140147ff0]
lea r9, [rbp - 0x28]
mov qword [rbp - 0x20], rbx
lea r8d, [rdx - 0x66]
movdqu xmmword [rbp - 0x18], xmm0
call fcn.140003c84
test eax, eax
js 0x14005e291
and qword [rbp - 0x40], 0
lea r8, str.AppID
and qword [rbp - 0x38], 0
lea rcx, [rbp - 0x40]
and qword [rbp - 0x30], 0
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
call fcn.140001d24
test eax, eax
je 0x14005e1e3
mov ecx, eax
call fcn.140001b60
mov ebx, eax
jmp 0x14005e27e
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x28]
and qword [rbp - 0x28], 0
mov r8, rbx
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
call fcn.140001c74
mov rdi, qword [rbp - 0x28]
test eax, eax
je 0x14005e215
mov ecx, eax
call fcn.140001b60
mov ebx, eax
jmp 0x14005e270
test rdi, rdi
jne 0x14005e232
lea r8, str.m_hKey___0
mov edx, 0x150a
lea rcx, str.sdkinc_atlmfc_atlbase.h
call fcn.140081b60
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test r14b, r14b
je 0x14005e26e
lea r8, [0x14016e3e8]
lea rdx, str.LocalService
lea rcx, [rbp - 0x28]
call fcn.140001dd8
call fcn.14005e318
test eax, eax
jne 0x14005e26e
mov ebx, 0x80004005
jmp 0x14005e270
xor ebx, ebx
test rdi, rdi
je 0x14005e27e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp - 0x40], 0
je 0x14005e28f
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005e634
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
call fcn.14005e758
test eax, eax
jne 0x14005e654
mov eax, 0x80004005
jmp 0x14005e748
and qword [rbp - 0x38], 0
lea r8, str.AppID
and qword [rbp - 0x30], 0
lea rcx, [rbp - 0x38]
and qword [rbp - 0x28], 0
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
call fcn.140001d24
test eax, eax
je 0x14005e692
mov ecx, eax
call fcn.140001b60
mov edi, eax
jmp 0x14005e735
mov rdx, qword [rbp - 0x38]
lea rdi, [0x140147ff0]
and qword [rbp - 0x50], 0
lea rcx, [rbp - 0x50]
and qword [rbp - 0x48], 0
mov r8, rdi
and qword [rbp - 0x40], 0
mov r9d, 0x20006
call fcn.140001d24
test eax, eax
je 0x14005e6cb
mov ecx, eax
call fcn.140001b60
jmp 0x14005e722
cmp qword [rbp - 0x50], 0
jne 0x14005e6ea
lea r8, str.m_hKey___0
mov edx, 0x150a
lea rcx, str.sdkinc_atlmfc_atlbase.h
call fcn.140081b60
mov rcx, qword [rbp - 0x50]
lea rdx, str.LocalService
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor r8d, r8d
mov qword [rbp - 0x18], rdi
lea rax, str.APPID
xorps xmm0, xmm0
lea r9, [rbp - 0x20]
mov qword [rbp - 0x20], rax
movdqu xmmword [rbp - 0x10], xmm0
lea edx, [r8 + 0x67]
call fcn.140003c84
cmp qword [rbp - 0x50], 0
mov edi, eax
je 0x14005e735
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp - 0x38], 0
je 0x14005e746
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rdi, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret