joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r10, r8
mov rsi, rdx
mov r14, qword [rcx]
movups xmm1, xmmword [r8]
movabs r9, 0xcbf29ce484222325
mov rax, qword [r8 + 8]
lea r8, [rax + rax]
movq rax, xmm1
add r8, rax
cmp rax, r8
je 0x140008f08
lea r11, [0x140037f80]
movabs rbx, 0x100000001b3
nop
movsx rcx, byte [rax]
movsx rdx, byte [rcx + r11]
xor r9, rdx
imul r9, rbx
inc rax
cmp rax, r8
jne 0x140008ef0
movabs rax, 0xde5fb9d2630458e9
mul r9
lea r12, [rax + rdx]
mov r9, r12
mov r8, r10
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140008460
mov r15, qword [rsp + 0x20]
movzx ebp, byte [rsp + 0x28]
test bpl, bpl
je 0x140008fc9
mov rdi, r15
shl rdi, 6
add rdi, qword [r14 + 8]
mov qword [rsp + 0x78], rdi
mov rbx, qword [rsp + 0x88]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor r13d, r13d
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov r8, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, rdi
call fcn.140007310
nop
lea rcx, [rdi + 0x20]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
call fcn.140007310
nop
and r12b, 0x7f
mov rax, qword [r14]
mov byte [r15 + rax], r12b
mov rax, qword [r14 + 0x18]
lea rcx, [r15 - 0x10]
and rcx, rax
and eax, 0xf
add rcx, rax
mov rax, qword [r14]
mov byte [rcx + rax + 1], r12b
mov rdx, r15
shl rdx, 6
add rdx, qword [r14 + 8]
mov rcx, qword [r14]
add rcx, r15
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov byte [rsi + 0x10], bpl
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000f2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r9, qword [rcx]
mov r14, r8
mov rsi, rdx
mov rdi, rcx
test r9, r9
je 0x14000f385
mov rax, qword [rcx + 8]
mov ebx, dword [rsi]
lea rdx, [r9 + rax*2]
cmp r9, rdx
jae 0x14000f385
mov r12d, 0x20
lea r15d, [r12 - 0x16]
nop dword [rax + rax]
movzx r10d, word [r9]
mov eax, 0x3000
mov word [rbp - 0x48], ax
movzx ecx, r12w
lea rax, [rbp - 0x70]
mov dword [rbp - 0x70], 0x90020
mov dword [rbp - 0x6c], 0xd000a
mov dword [rbp - 0x68], 0xc000b
mov dword [rbp - 0x64], 0x20000085
mov dword [rbp - 0x60], 0x20022001
mov dword [rbp - 0x5c], 0x20042003
mov dword [rbp - 0x58], 0x20062005
mov dword [rbp - 0x54], 0x20092008
mov dword [rbp - 0x50], 0x2028200a
mov dword [rbp - 0x4c], 0x205f2029
nop dword [rax + rax]
cmp cx, r10w
je 0x14000f378
add rax, 2
lea rcx, [rbp - 0x46]
cmp rax, rcx
je 0x14000f3b0
movzx ecx, word [rax]
jmp 0x14000f360
add r9, 2
cmp r9, rdx
jb 0x14000f300
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140014ed0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx r8d, word [rdx - 2]
lea r11, [rdx - 2]
mov eax, 0x3000
mov dword [rbp - 0x40], 0x90020
mov word [rbp - 0x18], ax
movzx ecx, r12w
lea rax, [rbp - 0x40]
mov dword [rbp - 0x3c], 0xd000a
mov dword [rbp - 0x38], 0xc000b
mov dword [rbp - 0x34], 0x20000085
mov dword [rbp - 0x30], 0x20022001
mov dword [rbp - 0x2c], 0x20042003
mov dword [rbp - 0x28], 0x20062005
mov dword [rbp - 0x24], 0x20092008
mov dword [rbp - 0x20], 0x2028200a
mov dword [rbp - 0x1c], 0x205f2029
cmp cx, r8w
je 0x14000f428
add rax, 2
lea rcx, [rbp - 0x16]
cmp rax, rcx
je 0x14000f435
movzx ecx, word [rax]
jmp 0x14000f410
mov rdx, r11
cmp r9, r11
jb 0x14000f3b0
jmp 0x14000f385
cmp r9, rdx
jae 0x14000f385
cmp r10w, 0x2d
sete al
mov byte [r14], al
je 0x14000f452
cmp word [r9], 0x2b
jne 0x14000f45f
add r9, 2
cmp r9, rdx
jae 0x14000f385
test ebx, ebx
jne 0x14000f4bd
mov rax, rdx
sub rax, r9
sar rax, 1
cmp rax, 2
jl 0x14000f4a0
cmp word [r9], 0x30
jne 0x14000f4b8
movzx eax, word [r9 + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x14000f4ad
add r9, 4
mov ebx, 0x10
cmp r9, rdx
jae 0x14000f385
jmp 0x14000f507
cmp rax, 1
jl 0x14000f4b8
cmp word [r9], 0x30
jne 0x14000f4b8
mov ebx, 8
add r9, 2
jmp 0x14000f507
mov ebx, r15d
jmp 0x14000f507
cmp ebx, 0x10
jne 0x14000f4fb
mov rax, rdx
sub rax, r9
and rax, 0xfffffffffffffffe
cmp rax, 4
jl 0x14000f507
cmp word [r9], 0x30
jne 0x14000f507
movzx eax, word [r9 + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x14000f507
add r9, 4
cmp r9, rdx
jae 0x14000f385
jmp 0x14000f507
lea eax, [rbx - 2]
cmp eax, 0x22
ja 0x14000f385
mov qword [rdi], r9
sub rdx, r9
sar rdx, 1
mov al, 1
mov qword [rdi + 8], rdx
mov dword [rsi], ebx
jmp 0x14000f387
Function at 0x14000f9b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [rdx]
mov rbx, rcx
lea rdx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x50]
call fcn.140009b50
mov r8d, dword [rsp + 0x60]
lea rdx, [rsp + 0x50]
xor eax, eax
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x68], 0x10
mov rcx, rbx
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, 0xffffffffffffffff
cmp eax, 1
jne 0x14000fa22
mov ebx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000fa5b
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa56
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fa74
call fcn.140014f34
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140014ed0
add rsp, 0x80
pop rbx
ret
call fcn.14001bb3c
int3
Function at 0x140010fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [rsp + 0x60]
mov rbx, rcx
test eax, eax
movq rcx, xmm3
mov r10, rcx
mov r14d, 0xd
mov r11d, r14d
movabs r15, 0xfffffffffffff
cmovns r11d, eax
mov rbp, r8
and r10, r15
shr rcx, 0x34
mov r9, rdx
test ecx, ecx
jne 0x140011031
mov rax, r10
neg rax
sbb esi, esi
and esi, 0xfffffc02
jmp 0x140011037
lea esi, [rcx - 0x3ff]
movabs rdx, 0x10000000000000
mov rax, r10
or rax, rdx
test ecx, ecx
cmovne r10, rax
mov eax, esi
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
cmp r8d, 0xa
jae 0x140011066
mov edx, 4
jmp 0x140011081
cmp r8d, 0x64
jae 0x140011073
mov edx, 5
jmp 0x140011081
cmp r8d, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd rdi, r11d
sub rcx, r9
sar rcx, 1
cmp rcx, rdi
jge 0x1400110a1
mov qword [rbx], rbp
mov dword [rbx + 8], 0x84
jmp 0x1400111b6
xor eax, eax
test r11d, r11d
setg al
sub rcx, rdi
add rax, rdx
cmp rcx, rax
jl 0x140011092
cmp r11d, r14d
jge 0x1400110e0
lea rdi, [r10 + r10]
sub r14d, r11d
shl r14d, 2
lea rax, [rdi - 1]
or rax, r10
movzx ecx, r14b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, rdi
add r10, rdx
mov rax, r10
and r10, r15
shr rax, 0x34
add al, 0x30
movsx eax, al
mov word [r9], ax
add r9, 2
test r11d, r11d
jle 0x140011186
mov eax, 0x2e
lea r14, str.0123456789abcdefghijklmnopqrstuvwxyz
mov word [r9], ax
lea edi, [r11 - 1]
mov rax, r10
mov r15d, 0x30
shr rax, 0x30
mov ecx, r15d
movzx eax, word [r14 + rax*2]
mov word [r9 + 2], ax
add r9, 4
test edi, edi
je 0x140011186
movabs rdx, 0x1000000000000
test ecx, ecx
je 0x14001116e
lea rax, [rdx - 1]
sub ecx, 4
and r10, rax
ror rdx, 4
mov rax, r10
shr rax, cl
mov eax, eax
movzx eax, word [r14 + rax*2]
mov word [r9], ax
add r9, 2
sub edi, 1
jne 0x140011140
jmp 0x140011186
movsxd rdx, edi
test edi, edi
je 0x140011182
movzx eax, r15w
mov rdi, r9
mov rcx, rdx
rep stosw word [rdi], ax
lea r9, [r9 + rdx*2]
mov eax, 0x70
lea rdx, [r9 + 4]
mov word [r9], ax
test esi, esi
mov eax, 0x2d
mov ecx, 0x2b
cmovns ax, cx
mov rcx, rbx
mov word [r9 + 2], ax
mov r9d, r8d
mov r8, rbp
call fcn.1400111e0
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140011dc0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov dword [rsp + 0x70], 0
lea rax, [rsp + 0x68]
mov word [rsp + 0x74], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140011e5c
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], 1
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140014ed0
add rsp, 0x80
pop rbx
ret
Function at 0x140012550
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov r14, rdx
mov rdi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
movups xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1400542b0]
movdqu xmmword [rbp + 0x10], xmm1
xor r15d, r15d
mov word [rbp], r15w
mov rsi, qword [rcx + 0x68]
mov rbx, qword [rcx + 0x60]
cmp rbx, rsi
je 0x140012613
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400125df
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp]
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140011e80
add rbx, 0x20
cmp rbx, rsi
jne 0x1400125d2
mov edx, 0x400
movzx eax, byte [rdi + 0x7d]
cmp al, 1
jne 0x140012627
mov edx, 0x410
jmp 0x140012639
cmp al, 2
jne 0x140012639
mov edx, 0x8000400
or dword [rbp - 0x34], 1
mov word [rbp - 0x30], r15w
lea rax, [rdi + 0x20]
cmp qword [rax + 0x10], 0
jne 0x140012649
mov rax, r15
jmp 0x140012653
cmp qword [rax + 0x18], 8
jb 0x140012653
mov rax, qword [rax]
lea rcx, [rdi + 0x40]
cmp qword [rcx + 0x10], 0
jne 0x140012663
mov rcx, r15
jmp 0x14001266d
cmp qword [rcx + 0x18], 8
jb 0x14001266d
mov rcx, qword [rcx]
lea r11, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r11, qword [rbp]
cmp qword [rdi + 0x10], 0
jne 0x140012687
mov r10, r15
jmp 0x140012694
mov r10, rdi
cmp qword [rdi + 0x18], 8
jb 0x140012694
mov r10, qword [rdi]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x48], r8
lea r8, [rbp - 0x70]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, r11
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
je 0x140012721
lea rax, [0x14002a8f8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xe
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140001230
mov rbx, rax
mov rdx, rax
mov rcx, r14
call fcn.140006170
mov eax, dword [rbx + 0x20]
mov dword [r14 + 0x20], eax
lea rcx, [rbp + 0x20]
call fcn.1400011c0
xor bl, bl
jmp 0x14001273f
mov eax, dword [rbp - 0x80]
mov dword [rdi + 0x78], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rcx, [rbp]
call fcn.1400011c0
movzx eax, bl
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.140014ed0
mov rbx, qword [rsp + 0x190]
add rsp, 0x150
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012770
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rdx
mov rbx, rcx
call fcn.140011dc0
test al, al
je 0x1400127b5
mov rdx, r15
mov rcx, rbx
call fcn.140012550
jmp 0x14001297a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x55], xmm0
movups xmmword [rbp - 0x45], xmm0
movups xmmword [rbp - 0x35], xmm0
mov qword [rbp - 0x25], rax
mov dword [rbp - 0x1d], eax
movups xmmword [rbp - 0x19], xmm0
xor esi, esi
mov edx, esi
mov qword [rbp - 9], rdx
mov r8d, 7
mov qword [rbp - 1], r8
mov word [rbp - 0x19], si
lea r14d, [rax + 1]
mov rcx, qword [rbx + 0x60]
mov rax, qword [rbx + 0x68]
sub rax, rcx
sar rax, 5
cmp rax, r14
jbe 0x14001286f
mov edi, 0x20
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdi + rcx]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x140012821
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp - 0x19]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x19]
call fcn.140011e80
inc r14
add rdi, 0x20
mov rcx, qword [rbx + 0x60]
mov rax, qword [rbx + 0x68]
sub rax, rcx
sar rax, 5
cmp r14, rax
jb 0x140012810
mov r8, qword [rbp - 1]
mov rdx, qword [rbp - 9]
cmp qword [rbx + 0x10], 0
jne 0x140012882
cmp qword [rcx + 0x18], 8
jb 0x14001288f
mov rcx, qword [rcx]
jmp 0x14001288f
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001288f
mov rcx, qword [rbx]
mov qword [rbp - 0x71], rcx
test rdx, rdx
jne 0x14001289e
mov qword [rbp - 0x69], rsi
jmp 0x1400128af
lea rax, [rbp - 0x19]
cmp r8, 8
cmovae rax, qword [rbp - 0x19]
mov qword [rbp - 0x69], rax
lea rax, str.runas
mov qword [rbp - 0x79], rax
mov dword [rsp + 0x40], 0x70
mov qword [rsp + 0x48], rsi
mov eax, esi
cmp byte [rbx + 0x7d], 2
setne al
mov dword [rbp - 0x59], eax
mov dword [rsp + 0x44], 0x40
cmp qword [rbx + 0x30], 0
je 0x1400128f1
lea rsi, [rbx + 0x20]
cmp qword [rbx + 0x38], 8
jb 0x1400128f1
mov rsi, qword [rbx + 0x20]
mov qword [rbp - 0x61], rsi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
je 0x140012955
lea rax, str.ShellExecuteExW:
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x11
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 7]
call fcn.140001230
mov rbx, rax
mov rdx, rax
mov rcx, r15
call fcn.140006170
mov eax, dword [rbx + 0x20]
mov dword [r15 + 0x20], eax
lea rcx, [rbp + 7]
call fcn.1400011c0
xor bl, bl
jmp 0x14001296e
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x78], eax
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rcx, [rbp - 0x19]
call fcn.1400011c0
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140014ed0
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014120
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, rcx
test rdx, rdx
jne 0x14001424a
cmp rcx, 0xffffffffffffffff
je 0x1400141d2
xor esi, esi
lea rax, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rsi + 3]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400141d2
mov ebx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400141d2
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov r8, rdi
mov qword [rsp + 0x20], rax
lea edx, [rsi + 3]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, 1
je 0x1400141dc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor bl, bl
movzx eax, bl
jmp 0x1400142c8
mov eax, dword [rdi]
lea rdx, [rax*2 + 1]
add rdx, rax
lea rax, [rdi + 4]
lea rdx, [rdi + rdx*4]
cmp rax, rdx
je 0x140014210
nop word [rax + rax]
mov dword [rax + 8], 2
add rax, 0xc
cmp rax, rdx
jne 0x140014200
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, 1
sete bl
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
jmp 0x1400142c8
mov rbx, qword [rdx]
mov rdi, qword [rdx + 8]
cmp rbx, rdi
je 0x1400142c6
xor esi, esi
nop dword [rax + rax]
mov rdx, qword [rbx]
lea r8, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, 1
jne 0x1400142bd
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r9d, 0x10
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, 1
jne 0x1400142bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x1400142e5
add rbx, 8
cmp rbx, rdi
jne 0x140014260
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140014ed0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x1400142c8
Function at 0x1400143d0
Capabilities:
Query service status
Start service

Disassembly:
push rbx
push rdi
sub rsp, 0x98
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbx], rax
test rax, rax
jne 0x140014459
lea rax, [0x14002bb20]
mov qword [rsp + 0x48], 0x24
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140001230
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140006170
mov eax, dword [rbx + 0x20]
lea rcx, [rsp + 0x50]
mov dword [rdi + 0x20], eax
call fcn.1400011c0
xor al, al
jmp 0x14001459c
mov r8d, 0x14
lea rdx, str.TrustedInstaller
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14001448a
lea rax, str.TiElevator::Elevate_OpenServiceW_
mov qword [rsp + 0x48], 0x22
jmp 0x140014415
mov qword [rsp + 0xc0], rbp
lea rcx, [rsp + 0x30]
xor ebp, ebp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x20], rcx
lea r8, [rbx + 0x20]
mov qword [rsp + 0x88], r14
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x80], r15
lea r9d, [rbp + 0x24]
mov dword [rsp + 0x30], ebp
mov r14d, ebp
xor dil, dil
xor sil, sil
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, 1
jne 0x14001457a
nop
mov eax, dword [rbx + 0x24]
cmp eax, 1
jne 0x140014506
test sil, sil
jne 0x140014551
mov rcx, qword [rbx + 8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, 1
jne 0x140014551
movzx esi, al
jmp 0x140014551
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400145c0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
mov eax, dword [rbx + 0x34]
test dil, dil
je 0x14001453c
cmp eax, ebp
jbe 0x14001452c
xor dil, dil
jmp 0x140014551
mov eax, dword [rbx + 0x38]
sub rcx, r14
cmp rcx, rax
ja 0x1400145b3
xor dil, dil
jmp 0x140014551
mov r14, rcx
xor edx, edx
mov ecx, 0xfa
mov ebp, eax
mov dil, 1
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x30]
mov r9d, 0x24
mov qword [rsp + 0x20], rax
lea r8, [rbx + 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, 1
je 0x1400144e0
xor al, al
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xc0]
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140014ed0
add rsp, 0x98
pop rdi
pop rbx
ret
mov ecx, 0x5b4
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001457a
mov al, 1
jmp 0x14001457c

Function at 0x140015c68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140015cb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140015cb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140015cb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140015cb2
cmp dword [rcx + 0x84], 0xe
jbe 0x140015cb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140015cb4
xor al, al
add rsp, 0x28
ret
Function at 0x14001b57c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001b3e7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001b3e7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b3e7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001b3e7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001b3e7
cmp dword [rcx + 0x84], 0xe
jbe 0x14001b3e7
cmp dword [rcx + 0xf8], 0
je 0x14001b3e7
mov ecx, ebx
call fcn.14001b498
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001b274
nop
cmp dword [rbp + 0x20], 0
je 0x14001b435
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001b440
int3
xor r8d, r8d
xor edx, edx
jmp 0x14001b378
Function at 0x140023e1c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140023ea3
mov rsi, rbx
cmp word [rax], bp
je 0x140023e62
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140023e4c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140023e48
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140020a2c
mov rdi, rax
test rax, rax
je 0x140023e90
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140016e80
mov rbp, rdi
xor ecx, ecx
call fcn.14001e594
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret