joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000014bf
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jmp 0x100012ab0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov ebx, eax
jne 0x100012ba9
test rcx, rcx
je 0x100012b1e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test ebx, ebx
mov qword [rsp + 0x40], rcx
jmp 0x100012b44
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1000014bf
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x100012ba9
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x48], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x100012b2c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x100012b96
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x100012bb4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1000218f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1000016ae
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x10001ba58
sub rsp, 0x258
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x240], rax
and qword [rsp + 0x38], 0
and dword [rsp + 0x34], 0
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x38]
lea rdx, [0x10000be50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001bb62
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10000be10]
xor r8d, r8d
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x10001bb0f
lea rcx, [0x10000bd60]
call qword [sym.imp.msvcrt.dll_wprintf]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10000bd18]
xor r8d, r8d
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x10001bb57
lea rcx, [0x10000bc50]
call qword [sym.imp.msvcrt.dll_wprintf]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x258
ret
Function at 0x10000172b
Capabilities:
Accept command line arguments
Modify service
Query service status
Start service

Disassembly:
jmp 0x10001b154
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
cmp byte [0x10002e389], 0
mov ebx, r9d
mov rsi, r8
je 0x10001b17a
or edi, 0xffffffff
jmp 0x10001b1b3
and dword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x60]
lea rcx, [0x10002e450]
mov rdx, rax
call fcn.1000016fe
cmp al, 1
jne 0x10001b1af
lea rcx, [0x10002e450]
mov edx, ebx
call fcn.1000016ea
mov edi, eax
jmp 0x10001b1b3
mov edi, dword [rsp + 0x60]
lea rcx, [0x10000bb98]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10001b2db
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rsi, rax
je 0x10001b2b7
lea rdx, [0x10000bb70]
mov r8d, 0x16
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x10001b2ae
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or edx, 0xffffffff
mov r8d, 2
mov r9d, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea r11, [0x10000bb6c]
lea r8, [rsp + 0x68]
mov edx, 1
mov rcx, rbx
mov qword [rsp + 0x68], r11
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
and dword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov r9d, 0x24
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b2a5
cmp dword [rsp + 0x74], 1
jne 0x10001b2a5
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r9d, 1
lea rdx, [0x10000bb58]
lea rcx, [0x10000b6e0]
mov r8d, r9d
mov dword [rsp + 0x20], 0xb
call fcn.1000018a7
lea r11, [rsp + 0xa0]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x100001843
Capabilities:
Query service status

Disassembly:
jmp 0x10001e150
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov esi, 0x80000000
xor edx, edx
xor ecx, ecx
mov r8d, esi
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp rax, rbx
mov rdi, rax
je 0x10001e1d9
lea rdx, [0x10000b900]
mov r8d, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp rax, rbx
mov rsi, rax
je 0x10001e1d0
lea rax, [rsp + 0x78]
lea r9d, [rbx + 0x24]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, ebx
je 0x10001e1c7
cmp dword [rsp + 0x34], 4
lea eax, [rbx + 1]
cmove ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10000185c
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x10001c9c8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
and dword [rax - 0x18], 0
and dword [rax + 0x20], 0
test r9, r9
mov rsi, r9
mov rbp, r8
jne 0x10001c9fe
mov eax, LoadRegTypeLib
jmp 0x10001cade
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x10001ca0b
and dword [rdi], 0
and qword [r9], 0
lea rax, [rsp + 0x38]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, eax
je 0x10001ca38
cmp eax, 2
je 0x10001ca9d
jmp 0x10001cade
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, eax
je 0x10001ca69
cmp eax, 0x7a
jne 0x10001ca9d
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.msvcrt.dll_malloc]
lea rcx, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
mov qword [rsi], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x10001cacc
mov rcx, qword [rsi]
test rcx, rcx
je 0x10001caaf
call qword [sym.imp.msvcrt.dll_free]
and qword [rsi], 0
test rdi, rdi
je 0x10001cacc
mov rcx, rsi
call fcn.100001348
test eax, eax
mov ebx, eax
jne 0x10001cacc
mov dword [rdi], 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x10001cadc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x100001875
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x100017610
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
mov eax, dword [r9]
and dword [r9], 0
mov rcx, qword [rcx]
add eax, eax
mov rbx, r8
mov rdi, r9
mov dword [rsp + 0x30], eax
lea rax, [r11 - 0x18]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x20], rax
xor r8d, r8d
mov qword [r11 - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100017690
cmp dword [rsp + 0x68], 1
je 0x100017664
cmp dword [rsp + 0x68], 2
je 0x100017664
mov eax, 0xd
jmp 0x100017690
test rbx, rbx
mov ecx, dword [rsp + 0x30]
je 0x10001768a
test ecx, ecx
je 0x100017686
test cl, 1
jne 0x10001765d
mov rax, rcx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x10001768a
jmp 0x10001765d
and word [rbx], 0
shr ecx, 1
xor eax, eax
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1000018ac
Capabilities:
Delete registry value
Set registry value

Disassembly:
jmp 0x10001a5c0
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov bpl, dl
mov rsi, rcx
call fcn.1000015cd
test eax, eax
je 0x10001a5e5
mov eax, 0x80004005
jmp 0x10001a792
mov rcx, qword [0x10002e3b0]
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov edx, 0x65
lea rax, [0x10000ba60]
lea rdi, [0x10000b6e0]
lea r8d, [rdx - 0x64]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdi
call fcn.10000161d
test eax, eax
js 0x10001a792
and qword [rsp + 0x98], 0
lea rax, [rsp + 0x98]
lea rdx, [0x10000ad20]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001a78b
and qword [rsp + 0x38], 0
mov rbx, qword [rsp + 0x98]
and qword [rsp + 0x30], 0
and qword [rsp + 0x90], 0
lea rcx, [rsp + 0x90]
mov rdx, rbx
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], eax
call fcn.100001758
test eax, eax
je 0x10001a6da
mov ecx, eax
call fcn.1000017cb
mov rcx, qword [rsp + 0x90]
test rcx, rcx
mov edi, eax
je 0x10001a6c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10001a6d3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10001a792
mov rdi, qword [rsp + 0x90]
lea rdx, [0x10000ba98]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test bpl, bpl
jne 0x10001a717
test rdi, rdi
je 0x10001a705
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10001a713
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001a792
lea rbp, [rsi + 0x68]
test rbp, rbp
jne 0x10001a72b
mov ecx, 0x80004005
call fcn.10000110e
int3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x10000ba98]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call fcn.100001145
test eax, eax
jne 0x10001a6f7
test rdi, rdi
je 0x10001a774
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10001a5db
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10001a5db
mov ecx, eax
call fcn.1000017cb
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000119a0
Capabilities:
Set registry value

Disassembly:
jmp 0x1000119a0
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
cmp r8, rdi
mov r12, rcx
jne 0x1000119d4
mov ecx, 0x80004005
call fcn.10000110e
int3
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 1
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
jne 0x1000119d7
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x100012ab0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jmp 0x100012ab0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov ebx, eax
jne 0x100012ba9
test rcx, rcx
je 0x100012b1e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test ebx, ebx
mov qword [rsp + 0x40], rcx
jmp 0x100012b44
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1000014bf
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x100012ba9
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x48], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x100012b2c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x100012b96
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x100012bb4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1000218f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1000169ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x1000169ec
push rbx
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x450], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x40], 0
mov rax, rdx
xor edx, edx
mov rbx, r8
mov qword [rsp + 0x38], rcx
lea r8d, [rdx + 2]
mov rcx, rax
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov rdi, rax
jne 0x100016a46
call fcn.1000013fc
mov ebx, eax
jmp 0x100016b54
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rbx, rax
jne 0x100016a67
call fcn.1000013fc
jmp 0x100016b49
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rsi, rax
je 0x100016a5d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
add eax, 1
cmp eax, ebx
jae 0x100016ab0
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x100016aa6
lea rcx, [rsp + 0x40]
call fcn.100001794
mov eax, 0x8007000e
jmp 0x100016b6c
test eax, eax
mov ecx, eax
je 0x100016aee
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x100016ae3
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x100016aee
lea rcx, [rsp + 0x40]
call fcn.100001316
mov r11, qword [rsp + 0x40]
jmp 0x100016af8
mov ecx, 0x80070057
call fcn.10000110e
int3
lea r11, [rsp + 0x48]
mov qword [rsp + 0x40], r11
test r11, r11
jne 0x100016b04
mov ebx, 0x8007000e
jmp 0x100016b4b
xor edx, edx
mov r9d, ebx
mov r8, rsi
lea ecx, [rdx + 3]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100016a5d
mov r8d, dword [rsp + 0x4a0]
mov ecx, eax
mov rax, qword [rsp + 0x40]
and word [rax + rcx*2], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1000010c3
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x100016b6a
lea rcx, [rsp + 0x40]
call fcn.100001794
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x460
pop rdi
pop rsi
pop rbx
ret

Function at 0x100017610
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x100017610
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
mov eax, dword [r9]
and dword [r9], 0
mov rcx, qword [rcx]
add eax, eax
mov rbx, r8
mov rdi, r9
mov dword [rsp + 0x30], eax
lea rax, [r11 - 0x18]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x20], rax
xor r8d, r8d
mov qword [r11 - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100017690
cmp dword [rsp + 0x68], 1
je 0x100017664
cmp dword [rsp + 0x68], 2
je 0x100017664
mov eax, 0xd
jmp 0x100017690
test rbx, rbx
mov ecx, dword [rsp + 0x30]
je 0x10001768a
test ecx, ecx
je 0x100017686
test cl, 1
jne 0x10001765d
mov rax, rcx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x10001768a
jmp 0x10001765d
and word [rbx], 0
shr ecx, 1
xor eax, eax
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100017d2c
Capabilities:
Access the windows event log

Disassembly:
jmp 0x100017d2c
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x270
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9, rdx
mov edx, 0x100
mov rbx, rcx
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 1]
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__vsnwprintf_s
and word [rsp + 0x25e], 0
cmp dword [rbx + 0x28c], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
jne 0x100017d9e
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__putws]
lea rdx, [rbx + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
mov rbx, rax
je 0x100017df0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
xor r8d, r8d
mov dx, 4
mov rcx, rbx
mov word [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x270
pop rbx
ret
Function at 0x100017fe4
Capabilities:
Create service

Disassembly:
jmp 0x100017fe4
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa90
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.1000015cd
test eax, eax
je 0x100018019
mov eax, 1
jmp 0x1000180fb
mov ebx, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1000180f9
cmp eax, ebx
je 0x1000180f9
lea ecx, [rax + 1]
mov word [rsp + 0x70], 0x22
add eax, 2
and word [rsp + rax*2 + 0x70], 0
mov word [rsp + rcx*2 + 0x70], 0x22
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
jne 0x10001811c
mov ebx, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
mov r8d, ebx
call fcn.10000154b
test eax, eax
jne 0x1000180e2
lea r8, [0x10000b7f0]
lea rcx, [rsp + 0x280]
mov rdx, rbx
call sub.msvcrt.dll_wcscpy_s
test eax, eax
je 0x1000180e2
cmp eax, 0xc
je 0x1000180d7
cmp eax, 0x16
je 0x1000180cc
cmp eax, 0x22
je 0x1000180cc
cmp eax, 0x50
je 0x1000180e2
mov ecx, 0x80004005
call fcn.10000110e
int3
mov ecx, 0x80070057
call fcn.10000110e
int3
mov ecx, 0x8007000e
call fcn.10000110e
int3
lea r8, [rdi + 0x68]
lea rdx, [rsp + 0x280]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.1000218f0
mov rbx, qword [rsp + 0xaa8]
add rsp, 0xa90
pop rdi
ret
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
lea rax, [0x10000b7e0]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
add rdi, 0x68
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x1000181ff
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 0x400
lea rdx, [rsp + 0x280]
mov r8d, ebx
mov ecx, 0xd80b
call fcn.10000154b
test eax, eax
jne 0x1000181f7
lea r8, [0x10000b7a0]
lea rcx, [rsp + 0x280]
mov rdx, rbx
call sub.msvcrt.dll_wcscpy_s
test eax, eax
je 0x1000181f7
cmp eax, 0xc
je 0x1000181ec
cmp eax, 0x16
je 0x1000181e1
cmp eax, 0x22
je 0x1000181e1
cmp eax, 0x50
je 0x1000181f7
mov ecx, 0x80004005
call fcn.10000110e
int3
mov ecx, 0x80070057
call fcn.10000110e
int3
mov ecx, 0x8007000e
call fcn.10000110e
int3
mov r8, rdi
jmp 0x1000180e6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001800f
Function at 0x1000198a0
Capabilities:
Create thread

Disassembly:
jmp 0x1000198a0
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
add rcx, 0x2b8
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, 0xb0
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x1000198d3
mov rcx, rax
call fcn.1000015f5
jmp 0x1000198d5
xor eax, eax
test rax, rax
mov qword [rbx + 0x2a8], rax
je 0x100019910
and dword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
lea r8, [0x10000137f]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
mov r9, rax
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x2b0], rax
lea rcx, [rbx + 0x2b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x100001582]
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x2a0], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x100019bf4
Capabilities:
Create thread

Disassembly:
jmp 0x100019bf4
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rdi + 0x50], rax
je 0x100019c52
lea rax, [rsp + 0x40]
lea r8, [0x100001073]
mov r9, rdi
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov rbx, rax
jne 0x100019c4f
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret