joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400087d0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x58]
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov esi, ecx
mov edx, 0x6e2fd63e
mov r8d, 0xfb104e9e
mov ecx, 0x467b4ff3
call fcn.140001390
lea rdx, [rsp + 0x40]
sub rdx, rax
xor r14d, r14d
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000881f
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14000883b
lea rdi, [rsp + 0x40]
mov edx, 0xea2651f1
mov ecx, 0xc272c850
mov r8d, 0x7f19c968
lea rdi, [rdi + rax*2]
call fcn.140001390
sub rdi, rax
movzx ecx, word [rax]
mov word [rdi + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140008866
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
test esi, esi
je 0x140008960
lea r8, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140008966
lea rdx, [rsp + 0x40]
mov r8d, pe_nt_image_headers64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400088b8
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov edi, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [rdi + 0x5b]
lea rcx, [rsp + 0x40]
call fcn.1400e9f08
test rax, rax
je 0x140008953
mov word [rax + 2], r14w
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x14000890b
mov edx, 0xa0fedd4d
mov ecx, 0x88aa4406
mov r8d, 0x35c145dd
lea ebx, [rbx*2 + 2]
call fcn.140001390
mov rcx, qword [rsp + 0x30]
mov rdx, rax
lea rax, [rsp + 0x40]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008966
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140008990
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov edx, 0x7adb1784
mov ecx, 0x528f8e83
mov r8d, 0xefe48f5f
xor ebx, ebx
call fcn.140001390
lea r9d, [rbx + 1]
mov rdx, rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400089e2
xor eax, eax
jmp 0x140008abb
mov edx, 0xf18581a1
mov ecx, 0xd9d11904
mov r8d, 0x64ba1939
call fcn.140001390
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov rdx, rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008aae
cmp dword [rsp + 0x40], ebx
jbe 0x140008aae
mov edx, dword [rsp + 0x40]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, 0xeef1182a
mov ecx, 0xc6a58063
mov r8d, 0x7bce80b2
mov rdi, rax
call fcn.140001390
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov rdx, rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008aae
jmp 0x140008aa2
lea rdx, [0x140129d88]
mov rcx, rdi
call fcn.1400e9a18
test eax, eax
je 0x140008aa9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
cmp word [rdi], bx
jne 0x140008a7e
jmp 0x140008aae
mov ebx, 1
mov rcx, qword [rsp + 0x50]
invalid
invalid
Function at 0x140008ac8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov edx, 0xee8d6bc1
mov ecx, 0xc6d9f3ac
mov r8d, 0x7bb2f34c
xor ebx, ebx
call fcn.140001390
lea r8, [0x140129d88]
lea rcx, [rbp + 0x160]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0xea18bc82
mov ecx, 0xc24c249d
mov r8d, 0x7f272432
call fcn.140001390
lea r8, [0x140129d88]
lea rcx, [rsp + 0x50]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x40]
lea edi, [rbx + 1]
lea rdx, [rsp + 0x50]
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008c3d
mov edx, 0x94ef108f
mov ecx, 0xbcbb8b5c
mov r8d, 0x1d08810
mov dword [rsp + 0x30], 0x208
call fcn.140001390
mov rcx, qword [rsp + 0x40]
mov rdx, rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008c32
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.1400e9a18
test eax, eax
jne 0x140008c32
mov edx, 0x1bc6796d
mov ecx, 0x3392e294
mov r8d, 0x8ef9e1fe
mov dword [rsp + 0x30], 4
call fcn.140001390
mov rcx, qword [rsp + 0x40]
mov rdx, rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008c32
cmp dword [rsp + 0x34], 4
jne 0x140008c32
cmp dword [rsp + 0x38], 3
cmove ebx, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140008c64
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov ebx, ecx
mov edx, 0x5de9bc02
mov r8d, 0xc8d624b2
mov ecx, 0x75bd278d
call fcn.140001390
lea rsi, [0x140129d88]
lea rcx, [rsp + 0x40]
mov rdx, rax
mov r8, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
xor edi, edi
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
test ebx, ebx
je 0x140008e6c
lea r8, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x140008cee
xor eax, eax
jmp 0x140008e7a
mov edx, 0x75f16486
mov ecx, 0x5da5ffc5
mov r8d, 0xe0cefc0b
call fcn.140001390
lea rcx, [rsp + 0x40]
mov r8, rsi
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0xe4545146
mov ecx, 0xcc00ca4b
mov r8d, 0x716bc9d9
lea ebx, [rax*2 + 2]
call fcn.140001390
mov rcx, qword [rsp + 0x38]
mov r9d, 2
mov rdx, rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0xc8335db9
mov ecx, 0xe067c6a2
mov r8d, 0x5d0cc520
lea ebx, [rax*2 + 2]
call fcn.140001390
mov rcx, qword [rsp + 0x38]
mov edi, 1
mov r9d, edi
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 0xe348c43
mov ecx, 0x2660177e
mov r8d, 0x9b0b14db
mov dword [rsp + 0x30], edi
call fcn.140001390
mov rcx, qword [rsp + 0x38]
lea ebx, [rdi + 3]
mov rdx, rax
lea rax, [rsp + 0x30]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 0xb6ea4404
mov ecx, 0x9ebedec5
mov r8d, 0x23d5dc97
mov dword [rsp + 0x30], 3
call fcn.140001390
mov rcx, qword [rsp + 0x38]
mov r9d, ebx
mov rdx, rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 0xd36f07d3
mov ecx, 0xfb3b9d04
mov r8d, 0x46509f43
mov dword [rsp + 0x30], edi
call fcn.140001390
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
mov rdx, rax
mov r9d, ebx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008e78
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
sete dil
mov eax, edi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140008f94
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15d, ecx
xor edi, edi
mov edx, 0x1edc834c
mov ecx, 0x368819a7
mov r8d, 0x8be31b97
mov dword [rbp + 0x58], edi
call fcn.140001390
lea r9d, [rdi + 3]
xor r8d, r8d
mov rdx, rax
lea rax, [rbp - 0x10]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140008ff2
xor eax, eax
jmp 0x140009188
mov edx, 0x85b6dfe7
mov ecx, 0xade245ee
mov r8d, 0x1089477f
call fcn.140001390
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x50]
mov rdx, rax
lea rax, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r12d, 2
test eax, eax
je 0x14000903b
mov eax, r12d
mov dword [rbp + 0x48], eax
jmp 0x140009048
cmp dword [rbp + 0x50], 7
jne 0x14000917c
mov eax, dword [rbp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, 8
mov rcx, rax
mov r8d, ebx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, 0x11556fe5
mov ecx, 0x3901f5c8
mov r8d, 0x846af77d
mov r14, rax
call fcn.140001390
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x50]
mov rdx, rax
lea rax, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x48]
test eax, eax
cmovne ecx, r12d
mov dword [rbp + 0x48], ecx
lea rcx, [0x140129d88]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [rbp + 0x48]
lea rbx, [rax*2 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, r14
mov ecx, r15d
mov rsi, rax
lea rax, [rbp + 0x58]
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.140008ea4
cmp dword [rbp + 0x58], edi
jbe 0x14000912d
mov edx, 0x890ec424
mov ecx, 0xa15a5e15
mov r8d, 0x1c315cbc
lea ebx, [rax + rax]
call fcn.140001390
mov rcx, qword [rbp - 0x10]
mov rdx, rax
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14000914f
mov edx, 0xea463649
mov ecx, 0xc212ab9c
mov r8d, 0x7f79aed1
call fcn.140001390
mov rcx, qword [rbp - 0x10]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 1
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140009198
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 0x4d7d3205
mov ecx, 0x6529affc
mov eax, eax
mov r8d, 0xd842aa99
lea rbx, [rbx + rax*2]
mov eax, 0x5c
mov word [rbx], ax
add rbx, 2
call fcn.140001390
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400091dc
lea rcx, str.xreveal.sys
sub rbx, rcx
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rbx + rcx + 0xe], ax
test ax, ax
jne 0x1400091f6
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140009214
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x550], rax
lea rdx, [rsp + 0x20]
mov ebx, ecx
call fcn.140009198
xor edi, edi
mov edx, edi
movzx eax, word [rsp + rdx + 0x20]
lea rdx, [rdx + 2]
mov word [rbp + rdx + 0x12e], ax
test ax, ax
jne 0x14000924f
lea rcx, [rbp + 0x130]
mov edx, 0x2e
call fcn.1400e9f08
mov dword [rax + 2], 0x6d0074
mov dword [rax + 6], 0x70
test ebx, ebx
je 0x140009326
lea rdx, [rbp + 0x340]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x340]
mov edx, 0x5c
call fcn.1400e9f08
mov rbx, rax
test rax, rax
je 0x14000933e
add rbx, 2
lea rdx, str.xreveal.sys
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
test rbx, rbx
je 0x14000933e
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x340]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000933e
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x340]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x14000933e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140009364
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
mov ebx, ecx
test ecx, ecx
je 0x140009390
call fcn.140009214
mov ecx, ebx
call fcn.140008c64
mov ecx, ebx
call fcn.140008f94
test ebx, ebx
je 0x140009440
call fcn.14002ae30
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400093f6
xor eax, eax
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov byte [rsp + 0x20], dil
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
call fcn.140031adc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x22], 1
jne 0x1400093f6
cmp byte [rsp + 0x23], 1
jne 0x1400093f6
xor eax, eax
jmp 0x14000945a
call fcn.140005bd0
mov ecx, 0x64
lea rdx, [rsp + 0x40]
test eax, eax
mov ebx, edi
cmovne ebx, ecx
call fcn.140009198
lea rcx, [rsp + 0x40]
mov edx, 0x2e
call fcn.1400e9f08
test rax, rax
je 0x140009458
mov dword [rax + 2], 0x6d0074
lea rcx, [rsp + 0x40]
mov dword [rax + 6], 0x70
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140009458
call fcn.140005bd0
mov ecx, 0x64
mov ebx, edi
test eax, eax
cmovne ebx, ecx
xor ecx, ecx
call fcn.140009214
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x14000a0d4
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebx, ebx
test eax, eax
jne 0x14000a10c
xor eax, eax
jmp 0x14000a16b
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000a108
lea ecx, [rax + 0x12]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x50
pop rbx
ret

Function at 0x14000a180
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x360
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rbx, rcx
lea rcx, [0x140165aca]
mov edx, 0x7ae9cd33
mov r8d, 0x18
call fcn.1400013c0
lea rdx, [rsp + 0x30]
sub rdx, rax
mov cl, byte [rax]
mov byte [rdx + rax], cl
inc rax
test cl, cl
jne 0x14000a1bd
or rdx, 0xffffffffffffffff
test rbx, rbx
je 0x14000a1fd
lea rcx, [rsp + 0x30]
mov rax, rdx
inc rax
cmp byte [rcx + rax], 0
jne 0x14000a1da
lea rcx, [rsp + 0x30]
add rcx, rax
mov byte [rcx], 0x2f
sub rcx, rbx
mov al, byte [rbx]
inc rbx
mov byte [rcx + rbx], al
test al, al
jne 0x14000a1f1
lea rax, [rsp + 0x140]
mov r9d, edx
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x140]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x360
pop rbx
ret

Function at 0x14000a268
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov qword [rsp + 0x20], 0x114
xor edi, edi
call fcn.1400ebf40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jae 0x14000a2f9
mov rbx, qword [0x140175ac0]
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 3
test rax, rax
je 0x14000a2ed
mov rcx, qword [rbx]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, qword [rbx + 8]
inc rdi
sub rax, qword [rbx]
sar rax, 3
cmp rdi, rax
jb 0x14000a2cd
mov rax, qword [rbx]
mov qword [rbx + 8], rax
call fcn.14000c884
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x14000a374
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [0x140175ab8], rcx
mov ecx, 0x30
call fcn.1400e92f4
test rax, rax
je 0x14000a3af
mov rdx, qword [0x140175aa0]
and qword [rax + 0x10], 0
and qword [rax + 0x20], 0
mov qword [rax], rdx
mov qword [rax + 8], rbx
mov byte [rax + 0x2a], 0
mov qword [0x140175a90], rax
mov rax, qword [0x140175aa8]
mov edx, dword [rax + 0x24]
shr edx, 6
and dl, 1
call fcn.14000cc78
mov rdx, rbx
call fcn.14000e5d0
lea rcx, [0x1401651aa]
mov edx, 0x6146d91c
mov r8d, 0x14
call fcn.140001120
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14000a425
lea rcx, [0x1401651c0]
mov edx, 0x5f54d327
mov r8d, 0x1a
call fcn.140001120
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140175bb8], rax
lea rcx, [fcn.1400074d4]
xor edx, edx
call fcn.140007680
lea rax, [rsp + 0x40]
lea r8, [0x140006e0c]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140175b70], rax
add rsp, 0x30
pop rbx
ret
Function at 0x14000b138
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x258
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x240], rax
add cl, 0x41
movzx eax, cl
lea rcx, [0x140175bc0]
mov rcx, qword [rcx + rax*8 - 0x208]
test rcx, rcx
je 0x14000b1c2
cmp byte [rcx + 0x9b], 0
je 0x14000b1c2
lea rdx, [rsp + 0x30]
call fcn.14002d100
lea rcx, [rsp + 0x30]
call fcn.140022910
test al, al
je 0x14000b1c2
mov edx, 0x242dba24
mov ecx, 0xa949e882
mov r8d, 0x4edd6b89
call fcn.140001438
lea r8, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x258
ret

Function at 0x14000b1dc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movzx eax, dl
xor edi, edi
mov rbx, rcx
lea ecx, [rax + 0x41]
and edx, 0xff00
mov dword [rbp + 0x49], 0x5c003a
mov word [rbp + 0x47], cx
mov word [rbp + 0x4d], di
cmp edx, 0x2000
je 0x14000b378
cmp edx, 0x2100
je 0x14000b342
cmp edx, 0x2200
je 0x14000b335
cmp edx, 0x2300
je 0x14000b328
cmp edx, 0x2400
je 0x14000b31e
cmp edx, 0x2500
je 0x14000b315
cmp edx, 0x2600
je 0x14000b30a
cmp edx, 0x2700
je 0x14000b306
cmp edx, 0x2800
jne 0x14000b389
lea r8d, [rdi + 0x6c]
lea rcx, [rbp - 0x25]
xor edx, edx
call fcn.1400ebf40
mov edx, 0x9f5051ee
mov ecx, 0x12340354
mov r8d, 0xf5a0804d
mov dword [rbp - 0x29], 0x70
mov dword [rbp - 0x25], InitCommonControls
mov qword [rbp - 0x21], rbx
call fcn.140001438
mov edx, 0x6ab8bcb0
mov qword [rbp - 0x19], rax
lea rax, [rbp + 0x47]
mov ecx, 0xe7dcee12
mov r8d, 0x486d19
mov qword [rbp - 0x11], rax
call fcn.140001438
lea rcx, [rbp - 0x29]
mov qword [rbp - 1], rdi
mov dword [rbp + 7], 5
mov qword [rbp + 0xf], rdi
mov qword [rbp - 9], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x14000b389
xor edx, edx
jmp 0x14000b30c
mov dl, 1
mov ecx, eax
call fcn.14000b098
jmp 0x14000b389
mov ecx, eax
call fcn.14000b138
jmp 0x14000b389
movzx edx, cx
call fcn.14000dd24
jmp 0x14000b389
movzx edx, cx
mov rcx, rbx
call fcn.1400154fc
jmp 0x14000b389
movzx edx, cx
mov rcx, rbx
call fcn.140015458
jmp 0x14000b389
mov edx, 0x6b6f524f
mov ecx, 0xe60b00dd
mov r8d, 0x19f83e2
call fcn.140001438
lea r8, [rbp + 0x47]
xor r9d, r9d
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14000b389
lea r8d, [rax + 0x41]
mov edx, 7
mov rcx, rbx
call fcn.14001fb68
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret