joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a8c0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140051268]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov r13, rcx
call fcn.140002db0
mov rcx, rax
lea r9, [0x140036098]
lea r8, str.Utils::GetProcessIDInCurrentLogOn
xor edx, edx
call fcn.1400151c0
xor r15d, r15d
mov ebx, r15d
mov qword [rsp + 0x30], rbx
call fcn.140002db0
cmp byte [rax + 0x64], r15b
je 0x14000a96e
lea ecx, [r15 + 0x28]
call fcn.14000e7f0
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14000a966
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140002db0
mov rdx, rax
lea r8, str.Utils::GetProcessIDInCurrentLogOn
mov rcx, rbx
call fcn.140010790
mov rbx, rax
jmp 0x14000a969
mov rbx, r15
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x14000aa58
mov esi, r15d
mov rcx, qword [rsp + 0x40]
cmp dword [rsp + 0x48], r15d
jbe 0x14000aa53
nop
mov r14d, esi
lea rax, [r14 + r14*2]
lea r12, [rax*8]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbp + r8*2], 0
jne 0x14000a9d0
mov rdx, rbp
mov rcx, qword [r12 + rcx + 8]
call fcn.140020ab0
test eax, eax
jne 0x14000aa42
mov rdi, qword [rsp + 0x40]
call fcn.140002db0
mov rcx, rax
mov eax, dword [rdi + r12]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi + r12 + 4]
mov dword [rsp + 0x20], eax
lea r9, str.Process_Id:__ld__Session_Id:__ld
lea r8, str.Utils::GetProcessIDInCurrentLogOn
mov edx, 2
call fcn.1400151c0
mov rcx, qword [rsp + 0x40]
mov eax, dword [r12 + rcx]
cmp dword [r13], eax
jne 0x14000aa47
lea rax, [r14 + r14*2]
mov r15d, dword [rcx + rax*8 + 4]
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x14000aa78
mov rcx, qword [rsp + 0x40]
inc esi
cmp esi, dword [rsp + 0x48]
jb 0x14000a9b0
call sub.WTSAPI32.dll_WTSFreeMemory
call fcn.140002db0
mov rcx, rax
lea r9, str.Could_not_find_the_correct_process_id_in_the_given_session
lea r8, str.Utils::GetProcessIDInCurrentLogOn
mov edx, 5
call fcn.1400151c0
call fcn.140002db0
mov rcx, rax
mov dword [rsp + 0x20], r15d
lea r9, str.Process_Id___d
lea r8, str.Utils::GetProcessIDInCurrentLogOn
mov edx, 1
call fcn.1400151c0
nop
test rbx, rbx
je 0x14000aab8
mov rcx, rbx
call fcn.140011230
mov edx, 0x28
mov rcx, rbx
call fcn.14000e830
mov eax, r15d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000ee50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000c000
Capabilities:
Create process on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140051268]
xor rax, rsp
mov qword [rbp + 0x70], rax
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea rcx, [rsp + 0x70]
movups xmmword [rsp + 0x74], xmm0
mov dword [rbp - 0x2c], eax
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
movaps xmm1, xmmword [0x140037df0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
movaps xmm0, xmmword [str.cmd.exe__C__net_stop_HPAudioAnalytics__net_start_HPAudioAnalytics_]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [0x140037e00]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [0x140037e20]
movaps xmmword [rbp - 0x10], xmm1
movaps xmm1, xmmword [0x140037e10]
movaps xmmword [rbp + 0x20], xmm0
movaps xmm0, xmmword [0x140037e40]
movaps xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [0x140037e30]
movaps xmmword [rbp + 0x40], xmm0
movsd xmm0, qword [0x140037e60]
movaps xmmword [rbp + 0x30], xmm1
movaps xmm1, xmmword [0x140037e50]
movsd qword [rbp + 0x60], xmm0
mov qword [rsp + 0x60], rax
movaps xmmword [rbp + 0x50], xmm1
call fcn.140002db0
mov rcx, rax
lea r9, str.Restarting_service...
lea r8, str.CMainService::RestartService
mov edx, 3
call fcn.1400151c0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x14000c162
mov qword [rsp + 0x190], rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
call fcn.140002db0
mov rcx, rax
mov dword [rsp + 0x20], ebx
lea r9, str.Restart_attempt_failed._Last_error:_0x_x_n
mov edx, 5
lea r8, str.CMainService::RestartService
call fcn.1400151c0
mov rbx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14000ee50
add rsp, 0x180
pop rbp
ret
Function at 0x14000d580
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x8a0
mov rax, qword [0x140051268]
xor rax, rsp
mov qword [rsp + 0x890], rax
movups xmm0, xmmword [str.HotKeyServiceUWP]
movzx eax, word [0x1400391c0]
mov rbx, rdx
movups xmm1, xmmword [0x1400391b0]
movzx edi, cx
xor edx, edx
mov r8d, 0x800
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x82]
movaps xmmword [rsp + 0x70], xmm1
mov word [rsp + 0x80], ax
call fcn.140017ce0
lea rsi, [rsp + 0x8d0]
call fcn.140002e90
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x80]
xor esi, esi
mov r9, rbx
mov r8d, 0x400
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
call fcn.14001f49c
lea rdx, str.HotKeyServiceUWP
xor ecx, ecx
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_RegisterEventSourceW]
mov rbx, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x14000d6ac
mov edx, edi
test edi, edi
je 0x14000d66b
sub edx, 1
je 0x14000d663
sub edx, 1
je 0x14000d65b
mov r9d, 0x60000000
jmp 0x14000d671
mov r9d, 0xa0000000
jmp 0x14000d671
mov r9d, 0xe0000000
jmp 0x14000d671
mov r9d, 0x20000000
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov ecx, 1
mov dword [rsp + 0x30], esi
movzx edx, di
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], rsi
lea r8d, [rcx + 1]
mov rcx, rbx
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.14000ee50
add rsp, 0x8a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000d6d0
Capabilities:
Create service
Modify service

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4c0
mov rax, qword [0x140051268]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r15, qword [rsp + 0x520]
mov rbp, r8
mov r12, qword [rsp + 0x528]
mov rdi, rdx
mov r13, qword [rsp + 0x530]
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
mov r14d, r9d
call fcn.140017ce0
xor edx, edx
lea rcx, [rsp + 0x290]
mov r8d, 0x20c
call fcn.140017ce0
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000d776
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.140008ac0
jmp 0x14000d89a
lea r9, [rsp + 0x80]
mov qword [rsp + 0x4b8], rbx
lea r8, str.__s_
mov edx, 0x106
lea rcx, [rsp + 0x290]
call fcn.14000dad0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000d7ce
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.140008ac0
jmp 0x14000d892
mov qword [rsp + 0x60], r13
xor eax, eax
mov qword [rsp + 0x58], r12
mov r9d, 0xf01ff
mov qword [rsp + 0x50], r15
mov r8, rdi
mov qword [rsp + 0x48], rax
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov rcx, rbx
lea rax, [rsp + 0x290]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x14000d841
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
call fcn.140008ac0
mov rcx, rbx
jmp 0x14000d88c
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14000d871
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.ChangeServiceConfig2__SERVICE_CONFIG_DESCRIPTION__failed_w_err_0x_08lx_n
call fcn.140008ac0
mov rdx, rsi
lea rcx, str._s_is_installed._n
call fcn.140008ac0
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x4b8]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.14000ee50
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d8c0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140051268]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
xor ebp, ebp
mov edi, ebp
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x28]
call fcn.1400160c0
nop
xor edx, edx
xor ecx, ecx
lea r8d, [rbp + 1]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000d937
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.140008ac0
jmp 0x14000da34
mov r8d, 0x10024
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14000d96a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.140008ac0
jmp 0x14000da34
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x14000da02
mov rdx, rbx
lea rcx, str.Stopping__s.
call fcn.140008ac0
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
je 0x14000d9e3
mov eax, dword [rsp + 0x34]
cmp eax, 3
jne 0x14000d9e7
lea rcx, [0x140036b18]
call fcn.140008ac0
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x14000d9b1
mov eax, dword [rsp + 0x34]
mov rdx, rbx
cmp eax, 1
lea rcx, str._n_s_is_stopped._n
je 0x14000d9fd
lea rcx, str._n_s_failed_to_stop._n
call fcn.140008ac0
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x14000da25
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
call fcn.140008ac0
jmp 0x14000da34
mov rdx, rbx
lea rcx, str._s_is_removed._n
call fcn.140008ac0
mov ebx, ebp
nop word [rax + rax]
mov dword [rsp + 0x20], ebp
lea rdx, str.HPHotkeyNotification.exe
lea rcx, [rsp + 0x28]
call fcn.1400163c0
lea r8, [rsp + 0x20]
lea rdx, str.HPHotkeyNotification.exe
lea rcx, [rsp + 0x28]
call fcn.140016220
inc ebx
cmp dword [rsp + 0x20], 0
je 0x14000da79
cmp ebx, 0x64
jl 0x14000da40
test rsi, rsi
je 0x14000da87
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rdi, rdi
je 0x14000da96
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x28]
call fcn.140016140
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000ee50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140012620
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov eax, dword [rcx + 0x220]
cmp eax, 0xffffffff
jne 0x1400127ad
xor r14d, r14d
mov dword [rbp + 0x20], r14d
mov dword [rbp - 0x30], 4
test r9, r9
je 0x14001266f
cmp word [r9], r14w
jne 0x140012676
lea r9, str.MaxLogSize
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x14003a540]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r14w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [r9 + r8*2], r14w
jne 0x1400126a0
mov rdx, r9
lea rcx, [rbp - 0x20]
call fcn.140002c80
nop
test rsi, rsi
je 0x140012703
mov dword [rbp - 0x2c], r14d
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140012703
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x140012703
mov dword [rbx + 0x220], eax
jmp 0x140012759
test rdi, rdi
je 0x14001274f
mov dword [rbp - 0x2c], r14d
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14001274f
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x14001274f
mov dword [rbx + 0x220], eax
jmp 0x140012759
mov dword [rbx + 0x220], 0x800
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140012795
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012790
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400127c2
call fcn.14000e830
movdqa xmm0, xmmword [0x14003a540]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r14w
mov eax, dword [rbx + 0x220]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14001bd00
int3
Function at 0x140012920
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rbp - 0x40], r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rbp - 0x40], 1
lea rdx, [rbp + 0x48]
mov rcx, r14
call sub.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x140012b24
mov ecx, esi
call fcn.14000e840
mov rbx, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x140012b17
mov r9, rax
mov r8d, esi
mov edx, dword [rbp + 0x48]
mov rcx, r14
call sub.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW
test eax, eax
je 0x140012b17
mov qword [rbp - 0x38], r15
mov dword [rbp + 0x40], r15d
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x38]
lea rdx, str.StringFileInfo040904E4ProductName
mov rcx, rbx
call sub.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW
test eax, eax
je 0x140012a5f
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x140012a5f
mov r8d, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x14003a540]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.140002c80
nop
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.1400034a0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140012b05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012b00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012b41
jmp 0x140012b00
mov qword [rbp - 0x38], r15
mov dword [rbp + 0x40], r15d
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x38]
lea rdx, str.StringFileInfo040904B0ProductName
mov rcx, rbx
call sub.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW
test eax, eax
je 0x140012b17
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x140012b17
mov r8d, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x14003a540]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.140002c80
nop
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.1400034a0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140012b05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012b00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012b3b
call fcn.14000e830
movdqa xmm0, xmmword [0x14003a540]
mov word [rbp - 0x20], r15w
movdqu xmmword [rbp - 0x10], xmm0
test rbx, rbx
je 0x140012b24
mov rcx, rbx
call fcn.14000e830
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14001bd00
int3
call fcn.14001bd00
int3
Function at 0x140014350
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rdi, rdx
mov rsi, qword [rdx + 0x18]
mov rax, qword [rdx + 0x38]
add rax, 0xa
add rsi, rax
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000e840
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400143e0
lea rax, [rdi + 0x28]
cmp qword [rax + 0x18], 8
jb 0x1400143b1
mov rax, qword [rax]
lea r9, [rdi + 8]
cmp qword [r9 + 0x18], 0x10
jb 0x1400143bf
mov r9, qword [r9]
mov qword [rsp + 0x20], rax
lea r8, str._S_:__s_r_n
mov rdx, rsi
mov rcx, rbx
call fcn.140014b20
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
nop
test rbx, rbx
je 0x1400143ed
mov rcx, rbx
call fcn.14000e830
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140014400
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov eax, dword [rdx + 0x48]
mov rbx, rdx
mov rdi, rcx
cmp eax, dword [rcx + 8]
jl 0x14001449c
cmp eax, 5
jg 0x14001449c
mov rcx, rdx
call fcn.1400121f0
cmp qword [rax + 0x18], 8
jb 0x140014433
mov rax, qword [rax]
mov r9d, dword [rbx + 0x48]
mov r10d, 1
mov qword [rsp + 0x60], rax
cmp r9d, 2
jl 0x140014467
cmp r9d, 3
jle 0x140014467
cmp r9d, 4
je 0x140014460
cmp r9d, 5
jne 0x140014467
movzx eax, r10w
jmp 0x14001446c
mov eax, 2
jmp 0x14001446c
mov eax, 4
xor edx, edx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rdx
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 0x18]
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r10w
mov qword [rsp + 0x20], rdx
movzx edx, ax
call qword [sym.imp.api_ms_win_eventlog_legacy_l1_1_0.dll_ReportEventW]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140014bf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140014ca8
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
call fcn.140017ce0
lea rax, [rsp + 0x258]
mov dword [rsp + 0x258], 0x100
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x240]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x240], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140014ca8
cmp dword [rsp + 0x240], 1
jne 0x140014ca8
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140014c84
test r8, r8
je 0x140014ca8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140002c80
mov eax, 1
jmp 0x140014caa
xor eax, eax
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140016220
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, r8
mov rbx, rdx
xor r14d, r14d
test r8, r8
jne 0x14001625e
mov eax, 0x80004003
jmp 0x14001639c
test rbx, rbx
je 0x140016394
cmp r14w, word [rdx]
je 0x140016394
mov dword [r8], r14d
mov qword [rbp + 0x220], r14
mov qword [rsp + 0x58], r14
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_07a4580a2d41a7635afdf5f0258b0c87___void___.0
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov qword [rbp + 0x228], rax
mov qword [rbp - 0x58], r14
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400162fb
lea rax, [rsp + 0x20]
cmp rcx, rax
jne 0x1400162f2
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 8]
mov qword [rbp - 0x58], rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400162fb
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x1400162f6
mov qword [rbp - 0x58], rcx
mov qword [rsp + 0x58], r14
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001631b
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x58], r14
xor edx, edx
lea ecx, [rdx + 2]
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov qword [rbp + 0x220], rax
cmp rax, 0xffffffffffffffff
je 0x140016385
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x4c]
call fcn.140017ce0
mov dword [rbp - 0x50], 0x238
lea rdx, [rbp - 0x50]
mov rcx, rsi
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_Process32FirstW
test eax, eax
je 0x140016385
mov rdx, rbx
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x140016380
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0x220]
call sub.api_ms_win_core_toolhelp_l1_1_0.dll_Process32NextW
jmp 0x140016359
mov ecx, dword [rbp - 0x48]
mov dword [rdi], ecx
lea rcx, [rsp + 0x70]
call fcn.140016150
mov eax, r14d
jmp 0x14001639c
mov dword [r8], r14d
mov eax, 0x80070057
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret