joyce8/EMBER2024-capa huggingface dataset:
Function at 0x164ca4680
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rbx, qword [rbp + 0x57]
mov rdi, qword [rbp + 0x5f]
mov rsi, qword [rbp + 0x67]
mov r14, qword [rbp + 0x6f]
mov rdx, qword [rbp + 0x7f]
xor r15d, r15d
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], r15w
mov qword [rbp - 0x19], r15
xor r8d, r8d
lea rcx, [rbp - 0x39]
call fcn.164ca3cb0
cmp eax, 1
jne 0x164ca4838
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x164ca4770
cmp rdx, 1
jb 0x164ca473b
dec rdx
lea r9, [0x164ce02e0]
mov r8d, eax
lea rcx, [rbp - 0x39]
call fcn.164ccf5a0
test eax, eax
je 0x164ca4770
test rbx, rbx
je 0x164ca475a
mov r8d, 1
lea rdx, [0x164ce02e0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x164ca4775
mov r8d, 1
lea rdx, [0x164ce02e0]
lea rcx, [rbp - 0x39]
call fcn.164c97be0
test rbx, rbx
je 0x164ca4797
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x164ca4780
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.164c97be0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], 7
mov word [rbp - 0x11], r15w
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rdi
call fcn.164ca3a90
mov esi, eax
mov rdi, qword [rbp - 1]
mov edx, dword [rbp + 0x77]
test eax, eax
jne 0x164ca47f1
mov eax, 0x7a
cmp rdi, rdx
cmovae esi, eax
test edx, edx
je 0x164ca4824
test r14, r14
je 0x164ca4824
cmp rdi, rdx
jb 0x164ca4802
lea edi, [rdx - 1]
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea rbx, [rdi + rdi]
mov r8, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + r14], r15w
mov ecx, esi
call qword [sym.imp.aswCmnOS.dll_dep_osSetLastError]
nop
lea rcx, [rbp - 0x11]
call fcn.164c938b0
jmp 0x164ca4866
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x77]
mov dword [rsp + 0x20], eax
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, eax
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x164ca4875
call fcn.164cd6f98
nop
lea rcx, [rbp - 0x39]
call fcn.164c938b0
mov eax, edi
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x164ca6f30
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
test rcx, rcx
je 0x164ca70dc
test rdx, rdx
je 0x164ca70dc
mov qword [r11 - 0x20], rbp
lea rdx, [0x164ce0880]
mov r8d, 4
mov qword [r11 - 0x28], r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x164ca6fef
mov r8d, 4
lea rdx, str.___
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x164ca6fef
mov eax, 0x3a
cmp ax, word [rbx + 2]
jne 0x164ca7023
mov edx, 0x5c
cmp dx, word [rbx + 4]
jne 0x164ca7023
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor ebp, ebp
lea r14, [rsp + 0x24]
mov word [rsp + 0x226], bp
lea rcx, [rsp + 0x20]
jmp 0x164ca7060
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor ebp, ebp
lea rcx, [rsp + 0x28]
mov word [rsp + 0x226], bp
lea edx, [rbp + 0x5c]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov r14, rax
test rax, rax
jne 0x164ca705b
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbp, qword [rsp + 0x248]
mov r14, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x28]
mov r8d, esi
mov word [r14], bp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x164ca702e
mov eax, eax
cmp rax, rsi
jae 0x164ca702e
mov rax, 0xffffffffffffffff
mov rcx, rax
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x164ca7085
test rcx, rcx
je 0x164ca702e
lea rdx, [rsp + 0x20]
sub r14, rdx
sar r14, 1
lea rdx, [rbx + r14*2]
inc rax
cmp word [rdx + rax*2], 0
jne 0x164ca70a3
inc rax
add rax, rcx
cmp rax, rsi
jbe 0x164ca70c2
mov ecx, 0x7a
jmp 0x164ca7028
sub rsi, rcx
lea rcx, [rdi + rcx*2]
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 1
jmp 0x164ca7030
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x164ca7040
Function at 0x164ca7cb0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebp, ebp
mov rbx, rcx
mov qword [rcx + 0x10], rbp
mov rdi, rdx
mov qword [rcx + 8], rbp
mov esi, r9d
mov qword [rcx + 0x18], rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x50], 1
mov eax, ebp
sete al
mov dword [rbx], eax
cmp dword [rsp + 0x190], ebp
je 0x164ca7d36
mov r8, rdi
lea rdx, [0x164ce06f4]
lea rcx, [rsp + 0xd0]
call fcn.164ca8000
lea rdi, [rsp + 0xd0]
mov r8, rdi
lea rdx, str.GlobalOptE__s
lea rcx, [rsp + 0x60]
call fcn.164ca8000
call qword [sym.imp.aswCmnOS.dll_dep_secGetPublicSecurity]
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
lea rcx, [rax + 0x800]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 8], rax
test rax, rax
je 0x164ca7de4
mov r8, rdi
lea rdx, str.GlobalOptM__s
lea rcx, [rsp + 0x60]
call fcn.164ca8000
call qword [sym.imp.aswCmnOS.dll_dep_secGetPublicSecurity]
xor r9d, r9d
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x10
lea rdx, [rax + 0x800]
lea rcx, [r9 - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x164ca7de4
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x164ca7de4
cmp dword [rbx], ebp
jne 0x164ca7de4
xchg dword [rax], esi
cmp qword [rbx + 8], rbp
je 0x164ca7dfb
cmp qword [rbx + 0x10], rbp
je 0x164ca7dfb
mov eax, 1
cmp qword [rbx + 0x18], rbp
jne 0x164ca7dfd
mov eax, ebp
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x158
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x164ca8f10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rsi
mov dword [rsp + 8], ecx
push rdi
mov eax, 0x1080
call fcn.164cd8480
sub rsp, rax
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov edi, dword [rsp + 0x1090]
mov ecx, 1
mov edx, edi
call fcn.164ca8960
mov rsi, rax
test rax, rax
jne 0x164ca8f5c
lea eax, [rsi + 2]
jmp 0x164ca9065
mov qword [rsp + 0x1098], rbx
mov qword [rsp + 0x10a0], rbp
xor ebp, ebp
mov ebx, ebp
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], 0x200
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0xc50]
mov dword [rsp + 0x44], 0x418
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x450]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x28], rax
mov edx, ebx
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x164ca9049
cmp dword [rsp + 0x40], 3
jne 0x164ca9049
test edi, edi
jne 0x164ca8ff8
mov rax, rbp
nop dword [rax + rax]
movzx ecx, word [rsp + rax + 0x450]
mov word [rsp + rax + 0x50], cx
lea rax, [rax + 2]
test cx, cx
jne 0x164ca8fe0
jmp 0x164ca9010
mov r8d, 0x200
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x50]
call fcn.164c91730
mov r9d, edi
mov word [rsp + 0x850], bp
lea rdx, [rsp + 0x850]
lea rcx, [rsp + 0x50]
call fcn.164ca9390
mov r8d, edi
lea rdx, [rsp + 0x850]
lea rcx, [rsp + 0x50]
call sym.aswCmnBS.dll_cmnsWriteSecureData
inc ebx
jmp 0x164ca8f70
inc ebx
test eax, eax
je 0x164ca8f70
mov rbp, qword [rsp + 0x10a0]
xor eax, eax
mov rbx, qword [rsp + 0x1098]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.164cd6f70
mov rsi, qword [rsp + 0x10a8]
add rsp, 0x1080
pop rdi
ret
Function at 0x164ca90c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x1440
call fcn.164cd8480
sub rsp, rax
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x1430], rax
mov rbx, qword [rsp + 0x1460]
xor ecx, ecx
mov rbp, qword [rsp + 0x1468]
mov edi, dword [rsp + 0x1470]
call sym.aswCmnBS.dll_cmnbInit
mov edx, edi
mov ecx, 1
call fcn.164ca8960
mov rsi, rax
test rax, rax
jne 0x164ca913a
xor ecx, ecx
call sym.aswCmnBS.dll_cmnbFree
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x164ca91ff
lea rcx, [rsp + 0x30]
test edi, edi
jne 0x164ca9162
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x164ca9150
jmp 0x164ca916a
mov rdx, rbx
call fcn.164c91600
mov rdx, rbp
lea rcx, [rsp + 0x430]
call fcn.164c91600
lea rcx, [rsp + 0x430]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x164ca9190
lea eax, [rax*2 + 2]
mov ebx, 0x40
cmp eax, ebx
lea rcx, [rsp + 0x430]
mov r8d, 0x4f
cmova ebx, eax
mov edx, ebx
call qword [sym.imp.aswCmnIS.dll_cyphSimpleCode]
lea rax, [rsp + 0x430]
mov dword [rsp + 0x28], ebx
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call sym.aswCmnBS.dll_cmnbFree
mov eax, ebx
mov rcx, qword [rsp + 0x1430]
xor rcx, rsp
call fcn.164cd6f70
mov rbx, qword [rsp + 0x1478]
add rsp, 0x1440
pop rdi
pop rsi
pop rbp
ret
Function at 0x164ca9230
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1450
call fcn.164cd8480
sub rsp, rax
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x1440], rax
mov rbx, qword [rsp + 0x1480]
xor ecx, ecx
mov r14, qword [rsp + 0x1488]
mov ebp, dword [rsp + 0x1490]
mov edi, dword [rsp + 0x1498]
call sym.aswCmnBS.dll_cmnbInit
mov edx, edi
xor ecx, ecx
call fcn.164ca8960
mov rsi, rax
test rax, rax
jne 0x164ca92b1
xor ecx, ecx
call sym.aswCmnBS.dll_cmnbFree
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x164ca936d
mov dword [rsp + 0x30], 0x1000
lea rcx, [rsp + 0x40]
test edi, edi
jne 0x164ca92e2
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x164ca92d0
jmp 0x164ca92ea
mov rdx, rbx
call fcn.164c91600
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
lea rax, [rsp + 0x440]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x164ca932f
xor ecx, ecx
call sym.aswCmnBS.dll_cmnbFree
mov eax, ebx
jmp 0x164ca936d
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x440]
mov r8d, 0x4f
call qword [sym.imp.aswCmnIS.dll_cyphSimpleCode]
mov r8, rbp
lea rdx, [rsp + 0x440]
mov rcx, r14
call fcn.164c91730
lea ecx, [rbp - 1]
xor eax, eax
mov word [r14 + rcx*2], ax
xor ecx, ecx
call sym.aswCmnBS.dll_cmnbFree
xor eax, eax
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x1450
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x164ca9390
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1390]
mov eax, 0x1490
call fcn.164cd8480
sub rsp, rax
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rbp + 0x1380], rax
mov rbx, qword [rbp + 0x13c0]
xor ecx, ecx
mov r14, qword [rbp + 0x13c8]
mov edi, dword [rbp + 0x13d8]
call sym.aswCmnBS.dll_cmnbInit
mov edx, edi
xor ecx, ecx
call fcn.164ca8960
mov rsi, rax
test rax, rax
jne 0x164ca940e
xor ecx, ecx
call sym.aswCmnBS.dll_cmnbFree
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x164ca95e7
mov dword [rsp + 0x70], 0x1000
lea rcx, [rbp - 0x80]
test edi, edi
jne 0x164ca9442
sub rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x164ca9430
jmp 0x164ca944a
mov rdx, rbx
call fcn.164c91600
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x80]
lea rax, [rbp + 0x380]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x164ca9490
xor ecx, ecx
call sym.aswCmnBS.dll_cmnbFree
mov eax, ebx
jmp 0x164ca95e7
xor ebx, ebx
cmp qword [0x164cf5d48], rbx
je 0x164ca94a7
mov rax, qword [0x164cf5d40]
test rax, rax
jne 0x164ca9519
mov rax, qword [0x164cf5d38]
test rax, rax
jne 0x164ca94d5
lea rcx, str.CRYPT32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x164cf5d38], rax
test rax, rax
jne 0x164ca94d5
mov rax, qword [0x164cf5d40]
jmp 0x164ca9507
lea rdx, str.CryptProtectData
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x164cf5d38]
lea rdx, str.CryptUnprotectData
mov qword [0x164cf5d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x164cf5d40], rax
cmp qword [0x164cf5d48], rbx
je 0x164ca9596
test rax, rax
je 0x164ca9596
mov ecx, dword [rsp + 0x70]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], ecx
xor r9d, r9d
lea rcx, [rbp + 0x380]
mov dword [rsp + 0x40], 0x15
mov qword [rsp + 0x58], rcx
xor edx, edx
lea rcx, str.avast__Secure_Storage
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [0x164cdeeb8]
test eax, eax
je 0x164ca93fc
mov rdx, qword [rsp + 0x68]
mov r8d, 0x200
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x164ca95d6
mov r8d, 0x200
lea rdx, [rbp + 0x380]
mov rcx, r14
call fcn.164c91730
lea rcx, [rbp + 0x380]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x164ca95c0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x70], eax
xor ecx, ecx
mov word [r14 + 0x3fe], bx
call sym.aswCmnBS.dll_cmnbFree
xor eax, eax
mov rcx, qword [rbp + 0x1380]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x1490
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x164ca9610
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edx, edx
lea rcx, str.Shell_TrayWnd
xor ebx, ebx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x164ca96da
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rdi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x164ca96d2
lea r8, [rsp + 0x28]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x164ca96a7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x164ca969a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x164ca96af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x164ca96ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x40
pop rbx
ret
Function at 0x164cabcc0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [rsp + 0x60]
mov ebp, 1
mov r8d, ebp
xor edx, edx
xor ecx, ecx
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x164cabd54
lea r8d, [rbp + 3]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x164cabd4b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x164cabd42
mov ecx, dword [rsp + 0x24]
add ecx, 0xfffffffd
movzx ebx, bl
cmp ecx, ebp
cmovbe ebx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.164cd6f70
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x164cac0c0
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x164cac1b3
mov rdx, qword [rsp + 0x30]
lea r8d, [rbx + 1]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x164cac1aa
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x164cac194
mov rdx, qword [rsp + 0x30]
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x164cac171
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x164cac166
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x164cac179
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x164cac730
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rsi
sub rsp, 0x50
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x60]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x164cac813
mov r8d, 0x24
mov qword [rsp + 0x68], rdi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x164cac7f9
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x164cac7e6
lea rdx, [rsp + 0x20]
mov rcx, rbx
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x164cac7ee
cmp dword [rsp + 0x24], 3
jne 0x164cac7ee
mov ecx, 0x7d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x164cac7b7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x164cac801
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x164cac801
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rdi, qword [rsp + 0x68]
jmp 0x164cac819
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.164cd6f70
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
Function at 0x164cac840
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x164cac8db
mov rdx, qword [rsp + 0x30]
mov r8d, 0x10
mov qword [rsp + 0x38], rbx
mov rcx, rax
mov qword [rsp + 0x40], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x164cac8b8
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x164cac8ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x164cac8c0
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x164cac8c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x164cb07e0
Capabilities:
Get token membership

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x90
mov rax, qword [0x164cf5010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov ebx, dword [rsp + 0xa0]
call sym.aswCmnBS.dll_secIsSelfDefenseEnabled
mov ecx, ebx
test eax, eax
je 0x164cb081a
call sym.aswCmnBS.dll_secIsProcessTrusted
jmp 0x164cb0915
call sym.aswCmnBS.dll_secIsProcessDsaSigned
mov dword [rsp + 0x80], eax
test eax, eax
jne 0x164cb0915
mov r8d, ebx
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x164cb090e
lea r8, [rsp + 0x70]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x164cb0905
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x164cb08fa
lea rax, [rsp + 0x60]
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
xor eax, eax
mov word [rsp + 0x7c], 0x500
mov dword [rsp + 0x48], eax
mov r9d, 0x220
mov dword [rsp + 0x40], eax
mov dl, 2
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea r8d, [rax + 0x20]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x164cb08ef
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.164cd6f70
add rsp, 0x90
pop rbx
ret