joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018da30
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x38
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], r9
mov rbx, qword [rsp + 0xb0]
mov esi, dword [rsp + 0x88]
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0x30], 0
jne 0x14018da9b
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x30], 0
jne 0x14018da9b
xor edi, edi
jmp 0x14018daa6
mov rcx, qword [rcx]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edi, eax
xor ecx, ecx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x98]
cmp qword [rsp + 0x28], 0
jne 0x14018dad6
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x28], 0
jne 0x14018dad6
xor ebp, ebp
jmp 0x14018dae1
mov rcx, qword [rcx]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ebp, eax
mov r14d, dword [rsp + 0xa0]
mov r15d, dword [rsp + 0xa8]
mov rcx, rbx
call fcn.140128000
mov ebx, eax
mov r13d, dword [rsp + 0xb8]
lea r12, [0x1401d2bf0]
cmp qword [r12 - 8], 0
jne 0x14018dbe8
mov eax, dword [r12]
imul ecx, esi, 0x85ebca77
lea ecx, [rax + rcx + 0x24234428]
rol ecx, 0xd
imul ecx, ecx, 0x9e3779b1
rol ecx, 1
imul edx, edi, 0x85ebca77
lea edx, [rax + rdx - 0x7a143589]
rol edx, 0xd
imul edx, edx, 0x9e3779b1
rol edx, 7
add ecx, edx
imul edx, ebp, 0x85ebca77
add edx, eax
rol edx, 0xd
imul edx, edx, 0x9e3779b1
rol edx, 0xc
add ecx, edx
imul edx, r14d, 0x85ebca77
lea eax, [rax + rdx + 0x61c8864f]
rol eax, 0xd
imul eax, eax, 0x9e3779b1
rol eax, 0x12
add eax, ecx
imul ecx, r15d, 0xc2b2ae3d
lea eax, [rax + rcx + 0x1c]
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
imul ecx, ebx, 0xc2b2ae3d
add eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
imul ecx, r13d, 0xc2b2ae3d
add eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae3d
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
add rsp, 0x38
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400010ae
jmp 0x14018db16
Function at 0x140190ac0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x140190b11
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x140190d3b
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x140190b05
inc edx
cmp edx, r9d
jl 0x140190ae5
jmp 0x140190d3b
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [0x1402a4e20]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x140190c7b
add rax, 0x10
cmp rax, r8
jb 0x140190b58
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x140190d3b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140001168
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1400018e4
add rsp, 0x28
jmp 0x140001168
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000cb78], rbx
je 0x1400011b2
cmp rax, rbx
jne 0x1400011ca
mov edi, 1
mov eax, dword [0x14000cb80]
cmp eax, 1
jne 0x1400011d7
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14000124e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000119b
mov eax, dword [0x14000cb80]
test eax, eax
jne 0x140001244
mov dword [0x14000cb80], 1
lea r14, [0x1400096c0]
lea rbx, [0x1400096a8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140001236
test eax, eax
jne 0x14000123a
cmp qword [rbx], 0
je 0x14000122b
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x140009680]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140001202
test eax, eax
je 0x14000124e
mov eax, 0xff
jmp 0x1400013ab
mov dword [0x14000c224], 1
mov eax, dword [0x14000cb80]
cmp eax, 1
jne 0x140001276
lea rdx, [0x1400096a0]
lea rcx, [0x140009690]
call sub.msvcrt.dll__initterm
mov dword [0x14000cb80], 2
test edi, edi
jne 0x140001283
xor eax, eax
xchg qword [0x14000cb78], rax
cmp qword [0x14000cb88], 0
je 0x1400012c1
lea rcx, [0x14000cb88]
call fcn.140001850
test eax, eax
je 0x1400012c1
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000cb88]
mov r9, qword [0x140009680]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x14000134d
test cl, cl
je 0x1400012e4
test edi, edi
jne 0x14000134d
dec cl
cmp cl, 0x1f
ja 0x1400012f7
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400012e4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140007f9c
mov dword [0x14000c220], eax
cmp dword [0x14000c240], 0
jne 0x140001336
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000c224], 0
jne 0x14000134b
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000c220]
jmp 0x1400013ab
cmp cl, 0x22
jne 0x14000135f
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x140001371
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400012d4
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x14000173c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001788
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001780
cmp dword [rcx + 0x3c], edx
jl 0x140001780
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001780
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001788
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400022f0
Capabilities:
Get file version info

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
xor r15d, r15d
mov r12, r9
mov r14, rdx
mov r13, rcx
mov edi, r15d
mov dword [rbp + 0x58], r15d
mov ebx, r15d
cmp dword [rcx + 0x7c], r15d
jle 0x1400024f2
mov eax, r15d
mov qword [rbp - 0x18], rax
mov esi, dword [r13 + 0x80]
lea r8, [r13 + 0x84]
add rsi, rax
mov rcx, r14
mov eax, dword [rsi + r13 + 0xbc]
add r8, rax
call fcn.140002d34
test eax, eax
je 0x14000250b
lea rdx, [rbp + 0x48]
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x1400024c2
mov edx, r14d
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140002502
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x1400024f9
mov edx, dword [rbp + 0x48]
mov r8d, r14d
mov r14, qword [rbp + 0x50]
mov r9, rax
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
nop dword [rax + rax]
test eax, eax
je 0x1400024ae
lea r9, [rbp + 0x60]
mov rcx, r15
lea r8, [rbp - 0x10]
lea rdx, [0x14000987c]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
je 0x1400024b1
cmp dword [rbp + 0x60], r15d
je 0x1400024b1
mov rax, qword [rbp - 0x10]
lea rcx, [r13 + 0x90]
add rcx, rsi
mov edx, r15d
mov r9d, dword [rax + 0xc]
mov r8d, dword [rax + 8]
cmp r8d, dword [rcx - 0xc]
jae 0x140002434
or eax, 0xffffffff
jmp 0x140002449
jbe 0x14000243d
mov eax, 1
jmp 0x140002449
cmp r9d, dword [rcx - 8]
jb 0x14000242f
mov eax, r15d
seta al
mov dword [rbp + rdx - 0x28], eax
cmp r8d, dword [rcx]
jae 0x140002457
or eax, 0xffffffff
jmp 0x14000246c
jbe 0x140002460
mov eax, 1
jmp 0x14000246c
cmp r9d, dword [rcx + 4]
jb 0x140002452
mov eax, r15d
seta al
mov dword [rbp + rdx - 0x20], eax
add rcx, 0x18
add rdx, 4
cmp rdx, 8
jl 0x140002429
cmp dword [rbp - 0x28], r15d
jl 0x14000248a
cmp dword [rbp - 0x20], r15d
jle 0x1400024b1
cmp dword [rbp - 0x24], r15d
jl 0x140002496
cmp dword [rbp - 0x1c], r15d
jle 0x1400024b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
mov dword [r12], ebx
mov esi, r15d
jmp 0x140002517
xor r15d, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
jmp 0x1400024da
cmp dword [rsi + r13 + 0x84], r15d
jne 0x14000250b
cmp dword [rsi + r13 + 0x88], r15d
jne 0x14000250b
mov r14, qword [rbp + 0x50]
mov rax, qword [rbp - 0x18]
inc ebx
add rax, 0x3c
mov qword [rbp - 0x18], rax
cmp ebx, dword [r13 + 0x7c]
jl 0x140002334
mov esi, 1
jmp 0x14000250e
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
jmp 0x140002517
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
jmp 0x140002526
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
test rdi, rdi
je 0x140002526
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, esi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400026b8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test rcx, rcx
je 0x1400028ae
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x140002888
mov r15d, 0x104
lea rax, [rbp + 0x60]
mov rdi, rbx
lea rcx, [rbp + 0x60]
mov edx, r15d
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002730
mov al, byte [rdi + rcx]
test al, al
je 0x140002730
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140002712
test rdx, rdx
lea rax, [rcx - 1]
lea r8, [0x140009828]
mov rdx, r15
cmovne rax, rcx
lea rcx, [rbp + 0x60]
mov byte [rax], 0
call fcn.1400035a4
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
nop dword [rax + rax]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002888
mov r8, r15
lea rdx, [rbp + 0x60]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x140002798
mov al, byte [rdi + rdx]
test al, al
je 0x140002798
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x14000277a
test r8, r8
lea rax, [rdx - 1]
cmovne rax, rdx
test byte [rsp + 0x20], 0x10
mov byte [rax], 0
je 0x140002818
lea rdx, [0x14000982c]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
test eax, eax
je 0x14000284e
lea rdx, [0x140009830]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
test eax, eax
je 0x14000284e
lea r8, [rsp + 0x4c]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.1400035a4
lea r8, [0x140009760]
mov edx, r15d
lea rcx, [rbp + 0x60]
call fcn.14000882c
lea rcx, [rbp + 0x60]
call fcn.1400026b8
jmp 0x14000284e
lea r8, [rsp + 0x4c]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.1400035a4
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop dword [rax + rax]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [rax + rax]
test eax, eax
jne 0x140002773
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400013e0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x140002d34
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor esi, esi
mov rdi, r8
mov byte [rcx], sil
mov rbx, rcx
cmp byte [r8], 0x23
lea r12d, [rsi + 1]
jne 0x140002f39
add rdi, r12
movsx rcx, byte [rdi]
call qword [sym.imp.USER32.dll_CharUpperA]
nop dword [rax + rax]
mov rcx, rdi
mov r14, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rdi, rax
cmp r14b, 0x53
je 0x140002f1f
cmp r14b, 0x57
je 0x140002f09
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
mov dword [rsp + 0x34], 0x104
lea rax, [rsp + 0x40]
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002dfd
mov al, byte [r8 + rcx]
test al, al
je 0x140002dfd
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x140002ddf
test rdx, rdx
lea rax, [rcx - 1]
mov r8, rdi
mov edx, 0x104
cmovne rax, rcx
lea rcx, [rsp + 0x40]
mov byte [rax], sil
call fcn.14000882c
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x140002f4a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140009760]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140002ef6
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x140002eef
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop dword [rax + rax]
test eax, eax
je 0x140002eeb
lea r8, [rsp + 0x40]
mov edx, 0x104
sub r8, rbx
mov rcx, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002ed8
mov al, byte [r8 + rcx]
test al, al
je 0x140002ed8
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x140002eba
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], sil
mov esi, r12d
jmp 0x140002ef6
mov eax, dword [rsp + 0x30]
cmp eax, r12d
cmove esi, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140002f33
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
jmp 0x140002f4a
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
test esi, esi
jne 0x140002f5a
jmp 0x140002f4a
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
mov r8, rdi
mov edx, 0x104
mov rcx, rbx
call fcn.14000882c
mov eax, r12d
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400013e0
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002f88
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
lea rax, [rsp + 0x78]
xor ebx, ebx
mov r9d, 0x20019
mov dword [rsp + 0x70], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlSession_ManagerFileRenameOperations
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x14000302d
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x70]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret

Function at 0x140003040
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov edi, 0x104
lea rcx, [rsp + 0x20]
mov edx, edi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
test eax, eax
je 0x1400030e7
lea r8, str.wininit.ini
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.14000882c
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
nop dword [rax + rax]
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll__lopen]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400030e7
xor edx, edx
lea r8d, [rbx + 2]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll__llseek]
nop dword [rax + rax]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll__lclose]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400013e0
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x140003114
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [0x14000c14c]
xor r14d, r14d
mov dword [rbp + 0x3f], r14d
mov word [rbp + 0x43], 0x500
mov dword [rbp + 0x27], r14d
lea ebx, [r14 + 2]
cmp eax, ebx
jne 0x1400032f6
lea rcx, [rbp + 0x27]
call fcn.140002590
test eax, eax
jne 0x1400032dd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rbp + 0x2f]
lea edx, [rbx + 6]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
je 0x1400032f6
mov rcx, qword [rbp + 0x2f]
lea rax, [rbp + 0x2b]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
jne 0x1400032c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x1400032c8
mov edx, dword [rbp + 0x2b]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400032c8
mov r9d, dword [rbp + 0x2b]
lea rax, [rbp + 0x2b]
mov rcx, qword [rbp + 0x2f]
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x1400032b9
lea rax, [rbp + 0x37]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x3f]
mov dword [rsp + 0x48], r14d
mov r8d, 0x20
mov dword [rsp + 0x40], r14d
mov dl, bl
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x1400032b9
mov esi, r14d
cmp dword [rdi], r14d
jbe 0x1400032a9
mov ebx, 1
mov rdx, qword [rbp + 0x37]
mov ecx, esi
add rcx, rcx
mov rcx, qword [rdi + rcx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x1400032a0
add esi, ebx
cmp esi, dword [rdi]
jb 0x14000327a
jmp 0x1400032a9
mov dword [0x14000c14c], ebx
mov dword [rbp + 0x27], ebx
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, dword [rbp + 0x27]
jmp 0x1400032f6
mov ecx, dword [0x14000c14c]
mov ebx, 1
mov eax, dword [rbp + 0x27]
test eax, eax
cmovne ecx, ebx
mov dword [0x14000c14c], ecx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400013e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003328
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x140003384
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], FDIDestroy
mov edx, 0x4f0
xor ecx, ecx
call fcn.1400061b8
mov cl, byte [rsp + 0x30]
cmp byte [rdi], cl
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400013e0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret

Function at 0x1400033b8
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
jne 0x14000341b
and dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f5
mov dword [rsp + 0x20], FDIDestroy
call fcn.1400061b8
xor eax, eax
jmp 0x1400034b9
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
and qword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
jne 0x140003498
mov edx, 0x4f6
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
jmp 0x140003407
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
nop dword [rax + rax]
test eax, eax
jne 0x1400034b4
mov edx, 0x4f7
jmp 0x140003486
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400013e0
add rsp, 0x50
pop rbx
ret