joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov rbx, rdx
mov rdi, qword [rcx]
mov rax, r8
jb 0x140023c12
mov rax, qword [r8]
mov rcx, qword [r8 + 0x10]
movabs r9, 0xcbf29ce484222325
lea r10, [rax + rcx*2]
cmp rax, r10
je 0x140023c58
lea r11, [0x14006d430]
movabs rsi, 0x100000001b3
nop word [rax + rax]
movsx rcx, byte [rax]
inc rax
movsx rdx, byte [rcx + r11]
xor r9, rdx
imul r9, rsi
cmp rax, r10
jne 0x140023c40
movabs rax, 0xde5fb9d2630458e9
mov rcx, rdi
mul r9
lea rsi, [rax + rdx]
mov r9, rsi
lea rdx, [rsp + 0x20]
call fcn.140024080
movzx r11d, byte [rsp + 0x28]
mov r10, qword [rsp + 0x20]
test r11b, r11b
je 0x140023d4e
mov rax, qword [rsp + 0x68]
lea r9, [r10 + r10*2]
xorps xmm0, xmm0
shl r9, 5
add r9, qword [rdi + 8]
and sil, 0x7f
movzx r8d, sil
mov rdx, qword [rax]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
xor eax, eax
movups xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
mov qword [r9 + 0x18], rax
movups xmm0, xmmword [rcx]
movups xmmword [r9], xmm0
movups xmm1, xmmword [rcx + 0x10]
xorps xmm0, xmm0
movups xmmword [r9 + 0x10], xmm1
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov rcx, rdi
movups xmmword [r9 + 0x20], xmm0
mov qword [r9 + 0x30], rax
mov qword [r9 + 0x38], rax
movups xmm0, xmmword [rdx]
movups xmmword [r9 + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x10]
xorps xmm0, xmm0
movups xmmword [r9 + 0x30], xmm1
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 7
mov word [rdx], ax
movups xmmword [r9 + 0x40], xmm0
mov qword [r9 + 0x50], rax
mov qword [r9 + 0x58], rax
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [r9 + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [r9 + 0x50], xmm1
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], 7
mov word [rdx + 0x20], ax
mov rdx, r10
call fcn.1400196b0
mov rcx, qword [rdi]
lea rdx, [r10 + r10*2]
shl rdx, 5
mov rax, rbx
add rdx, qword [rdi + 8]
add rcx, r10
mov qword [rbx], rcx
mov qword [rbx + 8], rdx
mov rsi, qword [rsp + 0x48]
mov byte [rbx + 0x10], r11b
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140026f10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x30], 1
movaps xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x20], bp
mov r9d, 0x100
movzx r8d, byte [rsp + 0x60]
mov edx, r9d
call fcn.140003960
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140026f79
mov rdx, qword [rbx]
mov r8d, 0x100
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140026fbd
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140026f9d
mov rax, qword [rbx]
mov qword [rbx + 0x10], rbp
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rdx, rdi
xor r8d, r8d
mov rcx, rbx
call fcn.140002da0
cmp edi, 0x100
jb 0x140026fff
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140026fe0
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
jae 0x140026fff
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.140002da0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140028550
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x30], 1
movaps xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x20], bp
mov r9d, 0x1000
movzx r8d, byte [rsp + 0x60]
mov edx, r9d
call fcn.140003960
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400285b9
mov rdx, qword [rbx]
mov r8d, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x1400285fd
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400285dd
mov rax, qword [rbx]
mov qword [rbx + 0x10], rbp
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rdx, rdi
xor r8d, r8d
mov rcx, rbx
call fcn.140002da0
cmp edi, 0x1000
jb 0x14002863f
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140028620
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
jae 0x14002863f
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.140002da0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140028a20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140097050]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, qword [rdx + 8]
mov rbp, r8
mov rdi, qword [rdx]
mov rsi, rcx
test rbx, rbx
je 0x140028a96
xor r14d, r14d
mov r15d, 0xffffffff
nop dword [rax]
mov r8d, r15d
mov dword [rsp + 0x30], r14d
cmp rbx, r15
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov rdx, rdi
cmovb r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140028abc
mov eax, dword [rsp + 0x30]
add rdi, rax
sub rbx, rax
jne 0x140028a60
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003ac10
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x48], 0xb
lea rax, str.WriteFile:
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140001350
mov rdx, rax
mov rcx, rbp
mov rbx, rax
call fcn.140002f90
mov rdx, qword [rsp + 0x68]
mov eax, dword [rbx + 0x20]
mov dword [rbp + 0x20], eax
cmp rdx, 8
jb 0x140028b3d
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028b38
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b44
call fcn.14003ac6c
xor al, al
jmp 0x140028a98
call fcn.140041558
int3
Function at 0x140028b50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140097050]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, r8
mov rbp, rcx
mov rbx, qword [rdx]
mov r9, qword [rdx + 8]
test r9, r9
je 0x140028be7
mov eax, r9d
mov rdi, r9
xor r14d, r14d
mov r15d, 0xffffffff
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x30], r14d
mov r8d, r15d
cmp r9, r15
cmovb r8d, eax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140028ca8
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140028c0d
add rbx, rax
mov r9, rdi
sub r9, rax
mov eax, r9d
mov rdi, r9
jne 0x140028ba0
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003ac10
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x14008da30]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r14w
mov dword [rsp + 0x70], r14d
mov r8d, 0x1b
lea rdx, str.Reached_the_end_of_the_file
lea rcx, [rsp + 0x50]
call fcn.14000aaa0
mov dword [rsp + 0x70], 0x26
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140002f90
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x20], eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140028d29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028d36
jmp 0x140028d24
lea rax, str.ReadFile:
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0xa
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001350
mov rbx, rax
mov rdx, rax
mov rcx, rsi
call fcn.140002f90
mov eax, dword [rbx + 0x20]
mov dword [rsi + 0x20], eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140028d29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028d30
call fcn.14003ac6c
xor al, al
jmp 0x140028be9
call fcn.140041558
int3
call fcn.140041558
int3
Function at 0x14002ee00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140097050]
xor rax, rsp
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [rdx]
mov rbx, rcx
lea rdx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x50]
call fcn.140015720
mov r8d, dword [rsp + 0x60]
lea rdx, [rsp + 0x50]
xor eax, eax
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x68], 0x10
mov rcx, rbx
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, 0xffffffffffffffff
cmp eax, 1
jne 0x14002ee72
mov ebx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002eeab
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002eea6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002eec4
call fcn.14003ac6c
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003ac10
add rsp, 0x80
pop rbx
ret
call fcn.140041558
int3
Function at 0x140030430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [rsp + 0x60]
mov rbx, rcx
test eax, eax
movq rcx, xmm3
mov r10, rcx
mov r14d, 0xd
mov r11d, r14d
movabs r15, 0xfffffffffffff
cmovns r11d, eax
mov rbp, r8
and r10, r15
shr rcx, 0x34
mov r9, rdx
test ecx, ecx
jne 0x140030491
mov rax, r10
neg rax
sbb esi, esi
and esi, 0xfffffc02
jmp 0x140030497
lea esi, [rcx - 0x3ff]
movabs rdx, 0x10000000000000
mov rax, r10
or rax, rdx
test ecx, ecx
cmovne r10, rax
mov eax, esi
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
cmp r8d, 0xa
jae 0x1400304c6
mov edx, 4
jmp 0x1400304e1
cmp r8d, 0x64
jae 0x1400304d3
mov edx, 5
jmp 0x1400304e1
cmp r8d, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd rdi, r11d
sub rcx, r9
sar rcx, 1
cmp rcx, rdi
jge 0x140030501
mov qword [rbx], rbp
mov dword [rbx + 8], 0x84
jmp 0x140030616
xor eax, eax
test r11d, r11d
setg al
sub rcx, rdi
add rax, rdx
cmp rcx, rax
jl 0x1400304f2
cmp r11d, r14d
jge 0x140030540
lea rdi, [r10 + r10]
sub r14d, r11d
shl r14d, 2
lea rax, [rdi - 1]
or rax, r10
movzx ecx, r14b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, rdi
add r10, rdx
mov rax, r10
and r10, r15
shr rax, 0x34
add al, 0x30
movsx eax, al
mov word [r9], ax
add r9, 2
test r11d, r11d
jle 0x1400305e6
mov eax, 0x2e
lea r14, str.0123456789abcdefghijklmnopqrstuvwxyz
mov word [r9], ax
lea edi, [r11 - 1]
mov rax, r10
mov r15d, 0x30
shr rax, 0x30
mov ecx, r15d
movzx eax, word [r14 + rax*2]
mov word [r9 + 2], ax
add r9, 4
test edi, edi
je 0x1400305e6
movabs rdx, 0x1000000000000
test ecx, ecx
je 0x1400305ce
lea rax, [rdx - 1]
sub ecx, 4
and r10, rax
ror rdx, 4
mov rax, r10
shr rax, cl
mov eax, eax
movzx eax, word [r14 + rax*2]
mov word [r9], ax
add r9, 2
sub edi, 1
jne 0x1400305a0
jmp 0x1400305e6
movsxd rdx, edi
test edi, edi
je 0x1400305e2
movzx eax, r15w
mov rdi, r9
mov rcx, rdx
rep stosw word [rdi], ax
lea r9, [r9 + rdx*2]
mov eax, 0x70
lea rdx, [r9 + 4]
mov word [r9], ax
test esi, esi
mov eax, 0x2d
mov ecx, 0x2b
cmovns ax, cx
mov rcx, rbx
mov word [r9 + 2], ax
mov r9d, r8d
mov r8, rbp
call fcn.140003ce0
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140037dd0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140097050]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov r14, rdx
mov rdi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
movups xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x14008da30]
movdqu xmmword [rbp + 0x10], xmm1
xor r15d, r15d
mov word [rbp], r15w
mov rsi, qword [rcx + 0x68]
mov rbx, qword [rcx + 0x60]
cmp rbx, rsi
je 0x140037e93
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140037e5f
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp]
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140003100
add rbx, 0x20
cmp rbx, rsi
jne 0x140037e52
mov edx, 0x400
movzx eax, byte [rdi + 0x7d]
cmp al, 1
jne 0x140037ea7
mov edx, 0x410
jmp 0x140037eb9
cmp al, 2
jne 0x140037eb9
mov edx, 0x8000400
or dword [rbp - 0x34], 1
mov word [rbp - 0x30], r15w
lea rax, [rdi + 0x20]
cmp qword [rax + 0x10], 0
jne 0x140037ec9
mov rax, r15
jmp 0x140037ed3
cmp qword [rax + 0x18], 8
jb 0x140037ed3
mov rax, qword [rax]
lea rcx, [rdi + 0x40]
cmp qword [rcx + 0x10], 0
jne 0x140037ee3
mov rcx, r15
jmp 0x140037eed
cmp qword [rcx + 0x18], 8
jb 0x140037eed
mov rcx, qword [rcx]
lea r11, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r11, qword [rbp]
cmp qword [rdi + 0x10], 0
jne 0x140037f07
mov r10, r15
jmp 0x140037f14
mov r10, rdi
cmp qword [rdi + 0x18], 8
jb 0x140037f14
mov r10, qword [rdi]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x48], r8
lea r8, [rbp - 0x70]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, r11
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
je 0x140037fa1
lea rax, [0x14005aac8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xe
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140001350
mov rbx, rax
mov rdx, rax
mov rcx, r14
call fcn.140002f90
mov eax, dword [rbx + 0x20]
mov dword [r14 + 0x20], eax
lea rcx, [rbp + 0x20]
call fcn.1400012e0
xor bl, bl
jmp 0x140037fbf
mov eax, dword [rbp - 0x80]
mov dword [rdi + 0x78], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rcx, [rbp]
call fcn.1400012e0
movzx eax, bl
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14003ac10
mov rbx, qword [rsp + 0x190]
add rsp, 0x150
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140037ff0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x140097050]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rdx
mov rbx, rcx
call fcn.140005bc0
test al, al
je 0x140038035
mov rdx, r15
mov rcx, rbx
call fcn.140037dd0
jmp 0x1400381fa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x55], xmm0
movups xmmword [rbp - 0x45], xmm0
movups xmmword [rbp - 0x35], xmm0
mov qword [rbp - 0x25], rax
mov dword [rbp - 0x1d], eax
movups xmmword [rbp - 0x19], xmm0
xor esi, esi
mov edx, esi
mov qword [rbp - 9], rdx
mov r8d, 7
mov qword [rbp - 1], r8
mov word [rbp - 0x19], si
lea r14d, [rax + 1]
mov rcx, qword [rbx + 0x60]
mov rax, qword [rbx + 0x68]
sub rax, rcx
sar rax, 5
cmp rax, r14
jbe 0x1400380ef
mov edi, 0x20
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdi + rcx]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x1400380a1
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp - 0x19]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x19]
call fcn.140003100
inc r14
add rdi, 0x20
mov rcx, qword [rbx + 0x60]
mov rax, qword [rbx + 0x68]
sub rax, rcx
sar rax, 5
cmp r14, rax
jb 0x140038090
mov r8, qword [rbp - 1]
mov rdx, qword [rbp - 9]
cmp qword [rbx + 0x10], 0
jne 0x140038102
cmp qword [rcx + 0x18], 8
jb 0x14003810f
mov rcx, qword [rcx]
jmp 0x14003810f
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14003810f
mov rcx, qword [rbx]
mov qword [rbp - 0x71], rcx
test rdx, rdx
jne 0x14003811e
mov qword [rbp - 0x69], rsi
jmp 0x14003812f
lea rax, [rbp - 0x19]
cmp r8, 8
cmovae rax, qword [rbp - 0x19]
mov qword [rbp - 0x69], rax
lea rax, str.runas
mov qword [rbp - 0x79], rax
mov dword [rsp + 0x40], 0x70
mov qword [rsp + 0x48], rsi
mov eax, esi
cmp byte [rbx + 0x7d], 2
setne al
mov dword [rbp - 0x59], eax
mov dword [rsp + 0x44], 0x40
cmp qword [rbx + 0x30], 0
je 0x140038171
lea rsi, [rbx + 0x20]
cmp qword [rbx + 0x38], 8
jb 0x140038171
mov rsi, qword [rbx + 0x20]
mov qword [rbp - 0x61], rsi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
je 0x1400381d5
lea rax, str.ShellExecuteExW:
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x11
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 7]
call fcn.140001350
mov rbx, rax
mov rdx, rax
mov rcx, r15
call fcn.140002f90
mov eax, dword [rbx + 0x20]
mov dword [r15 + 0x20], eax
lea rcx, [rbp + 7]
call fcn.1400012e0
xor bl, bl
jmp 0x1400381ee
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x78], eax
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rcx, [rbp - 0x19]
call fcn.1400012e0
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14003ac10
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140039980
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140097050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, rcx
test rdx, rdx
jne 0x140039aaa
cmp rcx, 0xffffffffffffffff
je 0x140039a32
xor esi, esi
lea rax, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rsi + 3]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140039a32
mov ebx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140039a32
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov r8, rdi
mov qword [rsp + 0x20], rax
lea edx, [rsi + 3]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, 1
je 0x140039a3c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor bl, bl
movzx eax, bl
jmp 0x140039b28
mov eax, dword [rdi]
lea rdx, [rax*2 + 1]
add rdx, rax
lea rax, [rdi + 4]
lea rdx, [rdi + rdx*4]
cmp rax, rdx
je 0x140039a70
nop word [rax + rax]
mov dword [rax + 8], 2
add rax, 0xc
cmp rax, rdx
jne 0x140039a60
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, 1
sete bl
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
jmp 0x140039b28
mov rbx, qword [rdx]
mov rdi, qword [rdx + 8]
cmp rbx, rdi
je 0x140039b26
xor esi, esi
nop dword [rax + rax]
mov rdx, qword [rbx]
lea r8, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, 1
jne 0x140039b1d
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r9d, 0x10
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, 1
jne 0x140039b1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x140039b45
add rbx, 8
cmp rbx, rdi
jne 0x140039ac0
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ac10
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x140039b28
Function at 0x140039c30
Capabilities:
Query service status
Start service

Disassembly:
push rbx
push rdi
sub rsp, 0x98
mov rax, qword [0x140097050]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbx], rax
test rax, rax
jne 0x140039cb9
lea rax, [0x14005bce0]
mov qword [rsp + 0x48], 0x24
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140001350
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140002f90
mov eax, dword [rbx + 0x20]
lea rcx, [rsp + 0x50]
mov dword [rdi + 0x20], eax
call fcn.1400012e0
xor al, al
jmp 0x140039dfc
mov r8d, 0x14
lea rdx, str.TrustedInstaller
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbx + 8], rax
test rax, rax
jne 0x140039cea
lea rax, str.TiElevator::Elevate_OpenServiceW_
mov qword [rsp + 0x48], 0x22
jmp 0x140039c75
mov qword [rsp + 0xc0], rbp
lea rcx, [rsp + 0x30]
xor ebp, ebp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x20], rcx
lea r8, [rbx + 0x20]
mov qword [rsp + 0x88], r14
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x80], r15
lea r9d, [rbp + 0x24]
mov dword [rsp + 0x30], ebp
mov r14d, ebp
xor dil, dil
xor sil, sil
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, 1
jne 0x140039dda
nop
mov eax, dword [rbx + 0x24]
cmp eax, 1
jne 0x140039d66
test sil, sil
jne 0x140039db1
mov rcx, qword [rbx + 8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, 1
jne 0x140039db1
movzx esi, al
jmp 0x140039db1
add eax, 0xfffffffe
cmp eax, 1
ja 0x140039e20
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
mov eax, dword [rbx + 0x34]
test dil, dil
je 0x140039d9c
cmp eax, ebp
jbe 0x140039d8c
xor dil, dil
jmp 0x140039db1
mov eax, dword [rbx + 0x38]
sub rcx, r14
cmp rcx, rax
ja 0x140039e13
xor dil, dil
jmp 0x140039db1
mov r14, rcx
xor edx, edx
mov ecx, 0xfa
mov ebp, eax
mov dil, 1
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x30]
mov r9d, 0x24
mov qword [rsp + 0x20], rax
lea r8, [rbx + 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, 1
je 0x140039d40
xor al, al
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xc0]
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003ac10
add rsp, 0x98
pop rdi
pop rbx
ret
mov ecx, 0x5b4
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140039dda
mov al, 1
jmp 0x140039ddc