joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007a368
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x14007a3dc
call fcn.14007a89c
mov ebx, eax
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007a3d8
test byte [rcx + 0x1c], 1
je 0x14007a3d8
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bf250]
mov edx, 0x28
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.140003c68
mov eax, ebx
jmp 0x14007a3fe
cmp r9d, ebx
ja 0x14007a3f2
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x14007a3f9
mov eax, 0x8000ffff
jmp 0x14007a3fe
test ebx, ebx
je 0x14007a3f9
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14007aa4c
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
lea rax, [rax + 0x18]
mov rsi, rdx
mov dword [rsp + 0x50], edi
and dword [rax], edi
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 0x24]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14007aaf2
call fcn.14007a89c
mov ebx, eax
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007aad9
test byte [rcx + 0x1c], 1
je 0x14007aad9
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.14007a9a4
mov rcx, qword [str.8__r_]
lea edx, [rdi + 0xc]
lea r8, [0x1400bf260]
mov dword [rsp + 0x20], ebx
mov r9, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140003c68
mov edi, 1
test dil, 1
je 0x14007aaee
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14007aaee
call fcn.140083d40
mov eax, ebx
jmp 0x14007aaf4
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14007ab04
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
xor ebx, ebx
mov rdx, rcx
mov dword [rsp + 0x50], ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14007ab97
call fcn.14007a89c
mov edi, eax
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007ab7f
test byte [rcx + 0x1c], 1
je 0x14007ab7f
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14007a9a4
mov rcx, qword [str.8__r_]
lea edx, [rbx + 0xd]
lea r8, [0x1400bf260]
mov dword [rsp + 0x20], edi
mov r9, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140003c68
mov ebx, 1
test bl, 1
je 0x14007ab93
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14007ab93
call fcn.140083d40
mov eax, edi
jmp 0x14007ab99
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007ae38
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14007aed4
call fcn.14007a89c
mov ebx, eax
cmp eax, 0x80070420
jne 0x14007ae6d
lea eax, [rdi + 1]
jmp 0x14007aed6
mov rax, qword [str.8__r_]
lea rcx, str.8__r_
cmp rax, rcx
je 0x14007aebb
test byte [rax + 0x1c], 1
je 0x14007aebb
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.14007a9a4
mov rcx, qword [str.8__r_]
lea r8, [0x1400bf260]
mov edx, 0x10
mov dword [rsp + 0x20], ebx
mov r9, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140003c68
mov edi, 1
test dil, 1
je 0x14007aed0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14007aed0
call fcn.140083d40
mov eax, ebx
jmp 0x14007aed6
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14007aee8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d7c88]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdi, rcx
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
mov rdx, rcx
mov dword [rsp + 0x38], eax
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call fcn.14007ab04
test eax, eax
js 0x14007affc
cmp dword [rsp + 0x24], 1
jne 0x14007af3a
xor eax, eax
jmp 0x14007affc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x927c0
ja 0x14007aff7
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14007ab04
test eax, eax
js 0x14007affc
cmp dword [rsp + 0x24], 1
je 0x14007af33
cmp dword [rsp + 0x24], 3
je 0x14007af42
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14007afd2
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14007afd2
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007afce
test byte [rcx + 0x1c], 1
je 0x14007afce
mov edx, 0x11
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bf260]
mov r9d, ebx
call fcn.140004000
mov eax, ebx
jmp 0x14007affc
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
mov ebx, 0x80004005
cmp rcx, rax
je 0x14007afce
test byte [rcx + 0x1c], 1
je 0x14007afce
mov edx, 0x12
jmp 0x14007afbb
mov eax, 0x800705b4
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140083d20
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14007b160
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [rsp + 0x98]
xor ebx, ebx
mov rsi, rcx
mov dword [rsp + 0x88], ebx
or ecx, 0xffffffff
cmp edx, ecx
jne 0x14007b193
test rax, rax
je 0x14007b23e
and qword [rsp + 0x50], rbx
mov r8d, edx
and qword [rsp + 0x48], rbx
mov r9d, ecx
and qword [rsp + 0x40], rbx
mov edx, ecx
and qword [rsp + 0x38], rbx
mov rcx, rsi
and qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14007b23e
call fcn.14007a89c
mov edi, eax
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007b223
test byte [rcx + 0x1c], 1
je 0x14007b223
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.14007a9a4
mov rcx, qword [str.8__r_]
lea r8, [0x1400bf260]
mov edx, 0x16
mov dword [rsp + 0x20], edi
mov r9, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140003c68
mov ebx, 1
test bl, 1
je 0x14007b23a
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14007b23a
call fcn.140083d40
mov eax, edi
jmp 0x14007b240
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x14007b548
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [r9]
mov rdi, r9
mov eax, r14d
mov r15, r8
mov dword [rsp + 0x68], eax
mov rbp, rdx
cmp rax, r14
je 0x14007b57f
mov ebx, 0x80070057
jmp 0x14007b5c7
mov rbx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x14007b601
test rbx, rbx
je 0x14007b5e2
mov eax, dword [rsp + 0x68]
cmp rax, qword [rdi]
jbe 0x14007b5e2
mov ebx, 0x800700ea
mov qword [rdi], rax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, dword [rsp + 0x68]
mov r9, rdi
mov qword [rdi], rax
mov rdx, r14
mov r8d, dword [r15]
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call fcn.14007b4ac
jmp 0x14007b5c9
mov ebx, 0x80070002
cmp esi, ebx
jne 0x14007b63d
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007b5c7
test byte [rcx + 0x1c], 4
je 0x14007b5c7
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bf270]
mov edx, 0x16
mov r9, rbp
call fcn.140003b90
jmp 0x14007b5c7
mov ebx, 0x800700ea
cmp esi, ebx
je 0x14007b682
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007b67b
test byte [rcx + 0x1c], 1
je 0x14007b67b
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bf270]
mov edx, 0x17
mov dword [rsp + 0x20], esi
mov r9, rbp
call fcn.140003c68
mov ebx, esi
jmp 0x14007b5c7
mov eax, dword [rsp + 0x68]
cmp qword [rdi], rax
jb 0x14007b5c4
mov ebx, 0x8000ffff
jmp 0x14007b5c7
Function at 0x14007b994
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdi, rdx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x14007ba0b
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007b9fa
test byte [rcx + 0x1c], 1
je 0x14007b9fa
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bf270]
mov edx, 0x19
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140003e54
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
test eax, eax
js 0x14007ba0d
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14007bad0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rcx + 0x20], 0
mov r12, rdx
mov rdi, rcx
jne 0x14007bb03
mov eax, 0x80070057
jmp 0x14007bcbf
mov rsi, qword [rdi + 0x28]
mov r15, qword [rdi + 0x20]
mov r13, rsi
mov r14, qword [rdi + 0x18]
mov eax, esi
mov dword [rbp + 0x40], esi
cmp rax, rsi
je 0x14007bb26
mov ebx, 0x80070057
jmp 0x14007bc31
mov eax, r14d
cmp rax, r14
jne 0x14007bb1c
mov rcx, qword [rdi + 0x10]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x38], r8
mov edx, r14d
and qword [rsp + 0x30], 0
mov r8, r15
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14007bbc1
mov ecx, dword [rbp + 0x40]
mov edx, 0x800700ea
inc ecx
mov dword [rbp + 0x40], ecx
test r15, r15
je 0x14007bb85
mov eax, ecx
cmp rax, rsi
cmova ebx, edx
mov esi, ecx
mov eax, ebx
mov qword [rbp - 0x10], rsi
cmp ebx, edx
je 0x14007bc27
cmp ebx, 0x80070103
je 0x14007bc27
test ebx, ebx
js 0x14007bc31
mov r9, r15
lea r8, [rbp - 0x10]
mov rdx, r13
mov rcx, r14
call fcn.14007ba18
mov rsi, qword [rbp - 0x10]
jmp 0x14007bc27
cmp ebx, 0x80070103
jne 0x14007bbcd
mov eax, ebx
jmp 0x14007bc27
mov edx, 0x800700ea
cmp ebx, edx
je 0x14007bc0d
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007bc31
test byte [rcx + 0x1c], 1
je 0x14007bc31
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bf270]
mov edx, 0x1b
mov dword [rsp + 0x20], ebx
mov r9d, r14d
call fcn.140003e10
jmp 0x14007bc31
mov ecx, dword [rbp + 0x40]
inc ecx
mov eax, ecx
mov dword [rbp + 0x40], ecx
cmp rsi, rax
jb 0x14007bc23
mov ebx, 0x8000ffff
jmp 0x14007bc31
mov esi, ecx
mov eax, edx
mov ebx, eax
test eax, eax
jns 0x14007bcb1
cmp ebx, 0x80070103
je 0x14007bcaa
xor eax, eax
mov ecx, 0x800700ea
cmp ebx, ecx
cmovne eax, ebx
cmp eax, 0x8007139f
jne 0x14007bc59
inc qword [rdi + 0x18]
mov r8, qword [rbp + 0x50]
jmp 0x14007bb03
test eax, eax
js 0x14007bcbf
and qword [rbp + 0x40], 0
lea rcx, [rbp + 0x40]
mov rdx, rsi
call fcn.140056bc4
mov ebx, eax
test eax, eax
js 0x14007bc98
mov rcx, qword [rdi + 0x20]
mov rax, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rsi
test rcx, rcx
je 0x14007bb03
call fcn.140083d40
jmp 0x14007bc50
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14007bca6
call fcn.140083d40
mov eax, ebx
jmp 0x14007bcbf
and qword [r12], 0
jmp 0x14007bcbd
mov rax, qword [rdi + 0x20]
inc qword [rdi + 0x18]
mov qword [r12], rax
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007be04
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rsi, qword [rsp + 0xa8]
mov r10, rcx
mov rcx, qword [r9]
mov r14, r9
mov eax, ecx
mov rbp, rdx
mov qword [rsp + 0x40], rcx
mov r12, qword [rsi]
mov dword [r11 + 0x20], eax
cmp rax, rcx
je 0x14007be50
mov ebx, 0x80070057
jmp 0x14007bfcf
mov eax, r12d
mov dword [rsp + 0xa8], eax
cmp rax, r12
jne 0x14007be46
mov eax, ebp
cmp rax, rbp
jne 0x14007be46
mov r13, qword [rsp + 0xb0]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x98]
mov qword [rsp + 0x30], r13
xor edi, edi
mov qword [rsp + 0x28], r8
mov rcx, r10
mov r8, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14007bf67
mov edx, dword [rsp + 0x98]
mov ecx, 0x800700ea
inc edx
cmp qword [rsp + 0xa0], rdi
je 0x14007bedb
mov eax, edx
cmp rax, qword [r14]
cmova ebx, ecx
test r13, r13
je 0x14007beed
mov eax, dword [rsp + 0xa8]
cmp rax, qword [rsi]
cmova ebx, ecx
mov eax, edx
mov qword [r14], rax
mov eax, dword [rsp + 0xa8]
mov qword [rsi], rax
mov eax, ebx
cmp ebx, ecx
je 0x14007bfe2
mov ecx, 0x80070103
cmp ebx, ecx
je 0x14007bfe2
test ebx, ebx
js 0x14007bfcf
mov r9, qword [rsp + 0xa0]
mov r8, r14
mov rdx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.14007ba18
test eax, eax
js 0x14007bfe2
mov rax, qword [rsp + 0x90]
mov r9, rsi
mov rcx, qword [rsp + 0xa0]
mov rdx, r12
mov qword [rsp + 0x20], r13
mov r8d, dword [rax]
call fcn.14007b4ac
test eax, eax
cmovs edi, eax
mov eax, edi
jmp 0x14007bfe2
mov ecx, 0x80070103
cmp ebx, ecx
je 0x14007bfe0
mov ecx, 0x800700ea
cmp ebx, ecx
je 0x14007bfb0
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007bfcf
test byte [rcx + 0x1c], 1
je 0x14007bfcf
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bf270]
mov edx, 0x1d
mov dword [rsp + 0x20], ebx
mov r9d, ebp
call fcn.140003e10
jmp 0x14007bfcf
mov edx, dword [rsp + 0x98]
inc edx
cmp qword [r14], rdx
jb 0x14007bfd3
mov eax, dword [rsp + 0xa8]
cmp qword [rsi], rax
jb 0x14007bfd3
mov ebx, 0x8000ffff
mov eax, ebx
jmp 0x14007bfe2
mov eax, dword [rsp + 0xa8]
mov qword [rsi], rax
mov qword [r14], rdx
mov eax, ecx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14007c84c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400799fc
test al, al
je 0x14007c8b3
lea esi, [rdi + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, edi
jb 0x14007c89d
mov ecx, eax
sub ecx, ebx
cmp esi, ecx
ja 0x14007c8ca
sub ebx, eax
cmp ebx, 0x3e8
jb 0x14007c8ca
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400799fc
test al, al
jne 0x14007c881
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov al, 1
jmp 0x14007c8b5

Function at 0x14007d0a8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov eax, dword [0x1400d9284]
xor esi, esi
test eax, eax
je 0x14007d0d3
cmp eax, 1
setne al
mov byte [rcx], al
jmp 0x14007d255
mov qword [rbp + 0x28], rsi
lea rdx, str.IsWow64Process2
lea rcx, [rbp + 0x28]
call fcn.14007cfc8
cmp eax, 0x8007007f
jne 0x14007d0f3
mov rbx, rsi
jmp 0x14007d0ff
test eax, eax
js 0x14007d257
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x14007d17f
mov word [rbp + 0x28], si
mov word [rbp + 0x30], si
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movabs r10, 0xbd24a77672d3d270
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
mov rax, rbx
call qword [0x14009aae8]
test eax, eax
jne 0x14007d173
call fcn.14007a89c
mov ebx, eax
lea rdx, str.8__r_
mov rcx, qword [str.8__r_]
cmp rcx, rdx
je 0x14007d16c
test byte [rcx + 0x1c], 1
je 0x14007d16c
mov edx, 0x1e
mov r9d, ebx
lea r8, [0x1400bf310]
mov rcx, qword [rcx + 0x10]
call fcn.140004000
mov eax, ebx
jmp 0x14007d257
movzx eax, word [rbp + 0x28]
neg ax
jmp 0x14007d232
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 0x30], 0xc
je 0x14007d248
mov qword [rbp + 0x30], rsi
lea rdx, str.IsWow64Process
lea rcx, [rbp + 0x30]
call fcn.14007cfc8
cmp eax, 0x8007007f
jne 0x14007d1c3
mov rbx, rsi
jmp 0x14007d1cf
test eax, eax
js 0x14007d257
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x14007d248
mov dword [rbp + 0x28], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movabs r10, 0x9c44073830d36370
lea rdx, [rbp + 0x28]
mov rax, rbx
call qword [0x14009aae8]
test eax, eax
jne 0x14007d22d
call fcn.14007a89c
mov ebx, eax
lea rdx, str.8__r_
mov rcx, qword [str.8__r_]
cmp rcx, rdx
je 0x14007d16c
test byte [rcx + 0x1c], 1
je 0x14007d16c
mov edx, 0x1f
jmp 0x14007d159
mov eax, dword [rbp + 0x28]
neg eax
sbb ecx, ecx
neg ecx
inc ecx
mov dword [0x1400d9284], ecx
cmp ecx, 1
setne al
mov byte [rdi], al
jmp 0x14007d255
mov dword [0x1400d9284], 1
mov byte [rdi], sil
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007e9c0
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x20
and dword [rsp + 0x38], 0
mov rdx, r8
mov rbx, rcx
mov byte [rcx], 0
lea r8, [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14007ea25
call fcn.14007a89c
mov ebx, eax
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14007ea21
test byte [rcx + 0x1c], 1
je 0x14007ea21
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bf590]
mov edx, 0x1a
mov r9d, ebx
call fcn.140004000
mov eax, ebx
jmp 0x14007ea31
cmp dword [rsp + 0x38], 0
setne al
mov byte [rbx], al
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140080c34
Capabilities:
Get system firmware table

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, dword [rdx]
mov rbx, rdx
mov r8, rcx
mov edx, 0x56454453
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov ecx, eax
test eax, eax
jne 0x140080c6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x140080c7d
mov eax, dword [rbx]
cmp eax, ecx
mov dword [rbx], ecx
sbb ecx, ecx
and ecx, 0x80070008
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1400816e4
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rbx, rcx
mov ecx, dword [rcx]
mov rsi, rdx
mov r14d, 0x40
lea rdi, [rbx + 0x60]
mov byte [rcx + rbx + 0x20], 0x80
inc ecx
cmp ecx, 0x38
jbe 0x140081743
mov eax, ecx
mov edx, r14d
sub edx, ecx
lea rcx, [rbx + 0x20]
add rcx, rax
call fcn.140091d90
lea r9, [rsp + 0x40]
mov r8d, r14d
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.1400817d4
xor ecx, ecx
mov eax, ecx
mov edx, r14d
sub edx, ecx
lea rcx, [rbx + 0x20]
add rcx, rax
call fcn.140091d90
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
shl rax, 3
lea rdx, [rbx + 0x20]
bswap rax
mov r8, r14
mov qword [rbx + 0x58], rax
mov rcx, rdi
call fcn.1400817d4
mov rcx, rdi
mov r8d, 4
mov rax, qword [rcx]
lea rcx, [rcx + 8]
rol rax, 0x20
bswap rax
mov qword [rsi], rax
lea rsi, [rsi + 8]
sub r8, 1
jne 0x140081782
mov edx, 0x80
mov rcx, rbx
call fcn.140091d90
movups xmm0, xmmword [0x1400bf988]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1400bf998]
movups xmmword [rdi + 0x10], xmm1
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140083104
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r8, dword [0x14000003c]
lea rbx, [0x140000000]
add r8, rbx
mov rsi, rdx
mov ebp, ecx
cmp dword [r8 + 0x84], 0xd
jbe 0x140083182
mov r9d, dword [r8 + 0xf0]
test r9d, r9d
je 0x140083182
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
movzx r11d, word [r8 + 6]
add rcx, rax
mov r10d, dword [r9 + rbx + 0xc]
xor edx, edx
test r11d, r11d
je 0x140083182
mov r9d, dword [rcx + 0xc]
cmp r10d, r9d
jb 0x140083177
mov r8d, dword [rcx + 8]
lea eax, [r9 + r8]
cmp r10d, eax
jb 0x14008319d
inc edx
add rcx, 0x28
cmp edx, r11d
jb 0x140083161
mov dword [rsi], 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdi, r9
add rdi, rbx
je 0x140083182
cmp dword [0x1400d92a0], 0
jne 0x1400831d5
cmp dword [rcx + 0x24], 0
mov dword [0x1400d92a0], 1
jl 0x1400831c5
mov ecx, 0x19
int 0x29
mov rdx, r8
mov rcx, rdi
mov rbx, r8
call fcn.14008306c
jmp 0x1400831d8
mov rbx, r8
mov r9, rsi
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140083188
lea ecx, [rax + 0x19]
int 0x29
jmp 0x140083188
Function at 0x140083b5c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.1400840c0
test al, al
je 0x140083cbd
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.140084084
mov bl, al
mov ecx, dword [0x1400d8294]
cmp ecx, 1
je 0x140083cc8
test ecx, ecx
jne 0x140083be9
mov dword [0x1400d8294], 1
lea rdx, [0x14009ad10]
lea rcx, [0x14009ace0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x140083bca
mov eax, 0xff
jmp 0x140083cad
lea rdx, [0x14009acd8]
lea rcx, [0x14009ab08]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x1400d8294], 2
jmp 0x140083bf1
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.140084230
call fcn.140084678
mov rbx, rax
cmp qword [rax], 0
je 0x140083c2e
mov rcx, rax
call fcn.140084198
test al, al
je 0x140083c2e
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x14009aae8]
call fcn.140084680
mov rbx, rax
cmp qword [rax], 0
je 0x140083c50
mov rcx, rax
call fcn.140084198
test al, al
je 0x140083c50
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_wide_environment
mov rdi, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv
mov rbx, qword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
call main
mov ebx, eax
call fcn.1400847e4
test al, al
je 0x140083cd2
test sil, sil
jne 0x140083c87
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.140084254
mov eax, ebx
jmp 0x140083cad
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.140084690
nop
mov ecx, 7
call fcn.140084690
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.140084584
add rsp, 0x28
jmp 0x140083b5c

Function at 0x1400847e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008482e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008482e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008482e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008482e
cmp dword [rcx + 0x84], 0xe
jbe 0x14008482e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140084830
xor al, al
add rsp, 0x28
ret

Function at 0x140092000
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140092028
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140092028
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret