joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100001670
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10006e0c8]
jne 0x10001c684
rol rcx, 0x10
test cx, 0xffff
jne 0x10001c680
ret 0
ror rcx, 0x10
jmp 0x1000489f0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10006e580]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x10006e678]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100048a75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10006e580]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100048a97
mov rax, qword [rsp + 0x88]
mov qword [0x10006e678], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10006e618], rax
mov rax, qword [0x10006e678]
mov qword [0x10006e4f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10006e600], rax
mov dword [0x10006e4e0], 0xc0000409
mov dword [0x10006e4e4], 1
mov rax, qword [0x10006e0c8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10006e0d0]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100054f78]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10000aedc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x60
xor ebx, ebx
mov dword [rax - 0x28], 0x14
lea rax, [rax - 0x28]
mov qword [rsp + 0x30], rax
mov dword [rax + 8], ebx
mov qword [rax + 0xc], rbx
mov dword [rax + 0x14], ebx
mov dword [rax + 0x18], ebx
lea rax, [rsp + 0x48]
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 8]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, ebx
je 0x100021821
mov al, bl
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
cmp dword [rsp + 0x40], 0x14
jne 0x10000af32
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.10000ce6c
mov bl, al
jmp 0x10000af32

Function at 0x10000bdc0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
lea rcx, [0x10006e092]
mov rsi, r9
movzx ebp, r8w
mov edi, edx
call fcn.10000c110
test al, al
jne 0x10000be34
mov rcx, rbx
call fcn.10000be60
test eax, eax
je 0x10000be39
and qword [rsp + 0x40], 0
movzx eax, word [rsp + 0x80]
movzx r8d, word [rbx + 0x68]
mov rcx, qword [rbx + 0x60]
mov qword [rsp + 0x38], rsi
and dword [rsp + 0x30], 0
mov word [rsp + 0x28], ax
and qword [rsp + 0x20], 0
mov r9d, edi
movzx edx, bp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x10000c230
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
lea rax, [r11 - 0x18]
mov rdi, rcx
xor ebx, ebx
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleState
xor r8d, r8d
lea r9d, [rbx + 2]
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10000c2a9
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 3]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [rbx + 1]
movzx ecx, bl
cmp eax, ebx
cmove ecx, edx
mov bl, cl
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x10000c8c0
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push r12
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x10001fa42
test rcx, rcx
je 0x10001fa4c
and qword [rdx], 0
and qword [rsp + 0x48], 0
and dword [rsp + 0x90], 0
and dword [rsp + 0x98], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
xor r8d, r8d
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x10001fa9d
mov ecx, dword [rsp + 0x90]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call qword [case.0x10000fdea.1]
mov r12, rax
mov qword [rsp + 0x48], rax
jmp 0x10000c97b
test r12, r12
je 0x10001fa93
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsi], rax
test rax, rax
je 0x10001fa89
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x98]
mov r8, rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10001fa70
xor ebx, ebx
jmp 0x10000c9db
mov rcx, r12
call qword [case.0x10000fdea.0]
jmp 0x10000c9e6
mov eax, ebx
add rsp, 0x60
pop r12
pop rsi
pop rbx
ret
mov eax, 0x80004003
jmp 0x10000c9e8
mov eax, 0x80070057
jmp 0x10000c9e8
call fcn.10000c34c
mov ebx, eax
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_free]
and qword [rsi], 0
jmp 0x10000c9db
mov ebx, 0x8007000e
jmp 0x10000c9db
mov ebx, 0x8007000e
jmp 0x10000c9e6
mov ecx, eax
call fcn.10002f744
mov ebx, eax
jmp 0x10000c9e6
Function at 0x10000eb64
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rdi, rdx
mov rdx, rcx
xor ebx, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10000ebbe
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea edx, [rbx + 1]
movzx ecx, bl
cmp eax, ebx
cmove ecx, edx
mov bl, cl
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x10000ebd4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x120
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x10006e0c8]
xor rax, rsp
mov qword [rsp + 0x110], rax
and dword [rsp + 0x30], 0
and qword [rsp + 0x20], 0
mov ebx, 1
mov r9d, ebx
lea r8, str.SystemSetup
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.10000a778
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rsp + 0x100], 0
je 0x100020167
lea r8, [rsp + 0x30]
lea rdx, str.SystemSetupInProgress
lea rcx, [rsp + 0x50]
call fcn.10000ed50
test eax, eax
je 0x10000ec66
cmp dword [rsp + 0x30], 0
jne 0x10000ecec
xor edi, edi
and qword [rsp + 0x40], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.SystemSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000ecea
and dword [rsp + 0x34], edi
mov dword [rsp + 0x38], 4
and dword [rsp + 0x30], edi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Upgrade
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100020175
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x10000ecec
xor ebx, ebx
cmp dword [0x10006ec9c], 0
je 0x10000ed1a
mov al, byte [0x10006eca0]
cmp al, 4
jb 0x10002018c
movabs rax, 0x8000000000000200
test qword [0x10006ec88], rax
jne 0x100020199
lea rcx, [rsp + 0x50]
call fcn.10000a83c
mov eax, ebx
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.100001670
mov rbx, qword [rsp + 0x130]
add rsp, 0x120
pop rdi
ret
lea ecx, [rbx + 5]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10000ec66
cmp dword [rsp + 0x30], 4
jne 0x10000ecdb
cmp dword [rsp + 0x34], ebx
cmove edi, ebx
jmp 0x10000ecdb
test al, al
je 0x10000ed03
jmp 0x10000ed1a
mov rdx, qword [0x10006ec90]
mov rcx, rdx
and rcx, rax
cmp rcx, rdx
jne 0x10000ed1a
mov r8d, ebx
lea rdx, [0x100055418]
mov rcx, qword [0x10006ecf8]
call fcn.10003fa04
nop
jmp 0x10000ed1a
Function at 0x10000ed50
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
mov rcx, qword [rcx + 0xb0]
lea rax, [r11 + 8]
mov rbx, r8
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x18]
lea r9, [r11 + 0x20]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10000eda5
cmp dword [rsp + 0x68], 4
jne 0x10000eda5
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
mov eax, 1
jmp 0x10000ed9f
add rsp, 0x40
pop rbx
ret
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10000ed9f
Function at 0x10000edc0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.10000cffc
add rsp, 0x28
jmp 0x10000edd8
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x10006e088], rdi
jne 0x100028822
mov eax, dword [0x10006e0c0]
cmp eax, 1
je 0x100028841
mov eax, dword [0x10006e0c0]
test eax, eax
jne 0x100028858
mov dword [0x10006e0c0], 1
lea r12, [0x100054140]
lea rdi, [0x100054128]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10000ee7c
test eax, eax
jne 0x10000ee7c
mov rcx, qword [rdi]
test rcx, rcx
je 0x10000ee71
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10000ee5a
test eax, eax
jne 0x10002884e
mov eax, dword [0x10006e0c0]
cmp eax, 1
jne 0x10000eeac
lea rdx, [0x100054120]
lea rcx, [0x100053fc8]
call fcn.10011f000
mov dword [0x10006e0c0], 2
test esi, esi
jne 0x10000eeb9
xor eax, eax
xchg qword [0x10006e088], rax
cmp qword [0x10006fe40], 0
jne 0x100028867
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
jbe 0x10000ef03
cmp byte [rdi], 0x22
je 0x1000288be
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
jne 0x1000288d0
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10000eeda
cmp byte [rdi], 0
je 0x10000ef0c
test esi, esi
jne 0x10000eedf
cmp byte [rdi], 0
je 0x10000ef20
cmp byte [rdi], 0x20
ja 0x10000ef20
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10000ef0c
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.10000ef60
nop
jmp 0x100028890
cmp rax, rdi
jne 0x100028831
mov esi, 1
jmp 0x10000ee1c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000ee0b
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10000ee84
mov eax, 0xff
jmp 0x10002890a
mov dword [0x10007060c], 1
jmp 0x10000ee84
lea rcx, [0x10006fe40]
call fcn.10004898c
test eax, eax
je 0x10000eec7
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10006fe40]
nop
jmp 0x10000eec7
mov dword [0x100070608], eax
cmp dword [0x10006e0a8], 0
jne 0x1000288a7
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10007060c], 0
jne 0x1000288bc
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100070608]
jmp 0x10002890a
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
jmp 0x10000eee8
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10000eef9
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
Function at 0x10000f820
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
lea rax, [r11 + 0x18]
mov r8, rcx
mov r9d, 0x10
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x20], rdx
and qword [r11 - 0x28], 0
lea rdx, str.SoftwareMicrosoftWindows_SearchTracing
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x60], 4
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
add rsp, 0x48
ret

Function at 0x10001bbd8
Capabilities:
Get common file path
Set environment variable

Disassembly:
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x10001bbfc
lea rdx, [rsp + 0x30]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x100026f50
mov byte [0x10006e091], 1
jmp 0x10001bbfa
sub rsp, 0x258
mov rax, qword [0x10006e0c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp byte [0x10006e091], 0
je 0x10001bb8d
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.100001670
add rsp, 0x258
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x10001bbfc

Function at 0x100032b90
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x58
cmp byte [0x100070639], 0
jne 0x100032c56
cmp byte [0x100070638], 0
jne 0x100032c77
and qword [r11 - 0x18], 0
lea rax, [r11 - 0x18]
lea rdx, str.SoftwareMicrosoftWindows_Search
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x38], rax
mov byte [0x100070639], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100032c56
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [0x10005a550]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100032c44
cmp dword [rsp + 0x34], 4
jne 0x100032c44
mov byte [0x100070638], 1
cmp dword [rsp + 0x38], eax
ja 0x100032c4b
mov byte [0x100070638], 0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x100070638], 0
jne 0x100032c77
mov rcx, qword [0x10006ecf8]
lea rdx, [0x1000559d8]
call qword [sym.imp.ADVAPI32.dll_EventEnabled]
test al, al
je 0x100032c9d
mov r9, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
or edx, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.100032ca8
add rsp, 0x58
ret
Function at 0x100032ca8
Capabilities:
Print debug messages

Disassembly:
push rdi
mov eax, 0x3710
call fcn.10000a970
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x3720], rbx
mov rax, qword [0x10006e0c8]
xor rax, rsp
mov qword [rsp + 0x3700], rax
mov rax, r9
mov r9, qword [rsp + 0x3740]
mov r9, qword [r9]
mov r8, rax
mov edi, 0xdab
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__vsnwprintf]
xor ebx, ebx
cmp eax, ebx
jl 0x100032dba
cdqe
cmp rax, rdi
ja 0x100032dba
cmp rax, rdi
jne 0x100032d20
mov word [rsp + 0x1b96], bx
cmp byte [0x100070638], bl
je 0x100032d66
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str._4d__s_n
mov edx, 0xdac
lea rcx, [rsp + 0x1ba0]
call fcn.10000a5ec
cmp eax, ebx
jl 0x100032d66
lea rcx, [rsp + 0x1ba0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x10006ec9c], ebx
je 0x100032dba
mov al, byte [0x10006eca0]
cmp al, 4
jae 0x100032d7c
cmp al, bl
jne 0x100032dba
movabs rdx, 0x8000000000000004
test qword [0x10006ec88], rdx
je 0x100032dba
mov rcx, qword [0x10006ec90]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100032dba
lea r8, [rsp + 0x40]
lea rdx, [0x1000559d8]
mov rcx, qword [0x10006ecf8]
call fcn.100029648
nop
mov rcx, qword [rsp + 0x3700]
xor rcx, rsp
call fcn.100001670
mov rbx, qword [rsp + 0x3720]
add rsp, 0x3710
pop rdi
ret

Function at 0x100039bac
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r8
mov esi, edx
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r12d, r12d
cmp qword [rdi + 0xb0], r12
jne 0x100039bf5
lea ecx, [r12 + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100039cd1
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0xb0], eax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
mov r8, qword [rbx + 8]
mov edx, esi
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x100039c68
mov eax, dword [rsp + 0xb0]
add eax, eax
mov dword [rsp + 0xb0], eax
mov edx, dword [rsp + 0xb0]
cmp edx, dword [rbx + 0x10]
jbe 0x100039c62
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
nop
jmp 0x100039bff
cmp eax, r12d
je 0x100039c79
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100039cd1
mov eax, dword [rbx + 0x10]
dec eax
mov ecx, dword [rsp + 0xb0]
cmp ecx, eax
jbe 0x100039cbd
mov edx, 0x800700ce
lea rcx, [rsp + 0x70]
call fcn.100029020
lea rcx, [rsp + 0x50]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005cb70]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbx + 0x14], ecx
mov rdx, rcx
mov rcx, qword [rbx + 8]
mov word [rcx + rdx*2], r12w
mov eax, 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop r12
pop rdi
pop rsi
ret
Function at 0x10003b570
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x1f0
mov rax, qword [0x10006e0c8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
cmp dword [rcx], 2
mov rbx, rcx
jne 0x10003b78b
cmp dword [rcx + 0x10], 0
jle 0x10003b78b
mov r9d, dword [rcx + 0x14]
xor edi, edi
xor esi, esi
and dword [rsp + 0x5c], esi
lea r13d, [rdi + 0x10]
lea r8, str._08x
lea rcx, [rsp + 0x80]
xor ebp, ebp
mov rdx, r13
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x54], rsi
mov dword [rsp + 0x64], r9d
mov dword [rsp + 0x60], ebp
call fcn.10000a5ec
test eax, eax
js 0x10003b614
lea r8, [rsp + 0x80]
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleLastReported
lea rcx, [rsp + 0x50]
call fcn.10000aedc
mov ebp, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x54]
mov edi, dword [rsp + 0x50]
jmp 0x10003b616
xor al, al
test al, al
je 0x10003b62d
cmp edi, dword [rbx]
jne 0x10003b62d
cmp rsi, qword [rbx + 4]
jne 0x10003b62d
cmp ebp, dword [rbx + 0x10]
je 0x10003b78b
mov r9d, dword [rbx + 0x14]
lea r8, [0x10005ae28]
lea rcx, [rsp + 0xc0]
mov rdx, r13
call fcn.10000a5ec
test eax, eax
js 0x10003b78b
mov r9d, dword [rbx + 0x10]
lea r8, [0x100054cc0]
lea rcx, [rsp + 0xa0]
mov rdx, r13
call fcn.10000a5ec
test eax, eax
js 0x10003b78b
mov rax, qword [rbx + 4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
imul rax, rax, 0x2710
mov dword [rsp + 0x68], eax
shr rax, 0x20
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x10003b78b
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x10003b78b
lea rax, [rsp + 0xe0]
lea r8, [rsp + 0x50]
xor r9d, r9d
xor edx, edx
mov ecx, 0x800
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
jle 0x10003b78b
lea rax, [0x100052954]
lea rdx, str.Windows_Search_Service
xor ecx, ecx
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x98], rax
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x10003b78b
and qword [rsp + 0x40], 0
mov ecx, 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov word [rsp + 0x28], cx
and qword [rsp + 0x20], 0
lea edx, [rcx - 2]
lea r8d, [rcx - 3]
mov rcx, rbx
mov r9d, 0x800003f7
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.100001670
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret
Function at 0x10003cd3c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov edi, r9d
mov rsi, r8
mov r12d, edx
mov rbx, rcx
call sub.KERNEL32.dll_GetLastError
mov r13d, eax
test r12b, 2
je 0x10003cd77
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebp, 1
test bpl, r12b
je 0x10003ce37
cmp qword [rbx + 0xc0], 0
je 0x10003ce37
test edi, edi
jne 0x10003cdac
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
mov rdi, rcx
mov ecx, dword [rbx + 0xc8]
add edi, edi
mov edx, 0x7ffe2
lea eax, [rcx + rdi]
cmp eax, edx
jbe 0x10003ce19
cmp edi, edx
jbe 0x10003cdcb
cmp ecx, 0x10
je 0x10003cdd7
xor ebp, ebp
mov rcx, rbx
call fcn.10003d144
test ebp, ebp
jne 0x10003ce19
lea rdx, str.d:w7rtmendusermssearch2common_tracer_tracmain.h
lea rcx, [rsp + 0x40]
mov r9d, 0x80070057
mov r8d, 0xe6
call fcn.10002f710
lea rcx, [rsp + 0x20]
mov r8d, 0x20
mov rdx, rax
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005cb70]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3
mov ecx, dword [rbx + 0xc8]
mov r8d, edi
mov rdx, rsi
add rcx, qword [rbx + 0xc0]
call sub.msvcrt.dll_memcpy
add dword [rbx + 0xc8], edi
test r12b, 8
je 0x10003ce58
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, [0x10005b13c]
mov r8, rsi
add rcx, 0x60
call qword [sym.imp.msvcrt.dll_fprintf]
test r12b, 4
je 0x10003ce79
mov rcx, qword [sym.imp.msvcrt.dll__iob]
lea rdx, [0x10005b13c]
mov r8, rsi
add rcx, 0x30
call qword [sym.imp.msvcrt.dll_fprintf]
mov ecx, r13d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]