joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a00c
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400ae3a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
lea rdx, [r11 - 0x48]
xor eax, eax
xor edi, edi
movups xmmword [rsp + 0x50], xmm0
mov qword [r11 - 0x28], rax
mov rbp, rcx
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], edi
call fcn.14005a760
test eax, eax
je 0x14005a065
cmp dword [rsp + 0x40], edi
sete dil
mov ebx, edi
jmp 0x14005a217
mov qword [rsp + 0x30], rdi
mov r8d, 3
mov dword [rsp + 0x28], 0x20000000
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14005a0bc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14005a217
mov rcx, rsi
call fcn.140059ee4
mov ebx, eax
test eax, eax
je 0x14005a208
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], AtlComPtrAssign
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70000
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
jne 0x14005a12c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14005a208
mov ebx, dword [rsp + 0x64]
xor ecx, ecx
add ebx, 0x1ff
mov r8d, 0x3000
and ebx, 0xfffffe00
mov edx, ebx
lea r9d, [rcx + 4]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x14005a10d
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x14005a1ac
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80310000
jne 0x14005a1f1
mov ebx, edi
mov edx, 1
jmp 0x14005a1e9
mov edx, dword [rsp + 0x44]
xor r8d, r8d
mov rcx, r14
call fcn.14005ac38
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x14005a1db
cmp eax, 1
jne 0x14005a1d4
mov rcx, rsi
call fcn.140059b3c
mov ebx, eax
jmp 0x14005a1dd
mov ebx, 1
jmp 0x14005a1e1
mov ebx, edi
test ebx, ebx
js 0x14005a1f1
test ebx, ebx
sete dil
mov edx, edi
mov rcx, rbp
call fcn.14005a86c
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualFree]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14005b270
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14005a244
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x58], 4
cmp dword [0x1400af708], ebx
mov dword [rsp + 0x50], ebx
jne 0x14005a2c8
lea rax, [r11 + 0x10]
mov r9d, 0x20000010
mov qword [r11 - 0x18], rax
lea r8, str.CacheDisable
lea rax, [r11 + 8]
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFveDetect
mov qword [r11 - 0x28], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, 0xfffffffc
jne 0x14005a2c8
cmp eax, 1
je 0x14005a2c8
mov eax, dword [0x1400ae890]
cmp dword [rsp + 0x50], ebx
mov dword [0x1400af708], 1
cmovne eax, ebx
mov dword [0x1400ae890], eax
jmp 0x14005a2ce
mov eax, dword [0x1400ae890]
add rsp, 0x40
pop rbx
ret

Function at 0x14005a760
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov dword [rax + 0x18], 4
mov qword [rax + 0x20], rbx
mov r14, rdx
mov dword [rax + 8], ebx
mov rdi, rcx
mov esi, ebx
test rcx, rcx
je 0x14005a823
test rdx, rdx
je 0x14005a823
mov dword [rdx], ebx
call fcn.14005a244
test eax, eax
jne 0x14005a7ac
lea edi, [rbx + 1]
jmp 0x14005a84d
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.14005a2dc
mov rsi, qword [rsp + 0x78]
mov edi, eax
test eax, eax
js 0x14005a828
lea rax, [rsp + 0x70]
mov r9d, reloc.ATL.DLL_AtlModuleInit
mov qword [rsp + 0x30], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFveDetectCache
lea rax, [rsp + 0x60]
mov r8, rsi
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14005a814
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14005a828
cmp dword [rsp + 0x60], ebx
je 0x14005a828
mov dword [r14], 1
jmp 0x14005a828
mov edi, 0x80070057
test rsi, rsi
je 0x14005a84d
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test edi, edi
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14005a86c
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x58
and qword [rbp + 0x28], 0
xor eax, eax
and qword [rbp + 0x18], 0
mov rbx, rcx
and qword [rbp + 0x30], 0
test edx, edx
setne al
mov dword [rbp + 0x20], eax
test rcx, rcx
je 0x14005a9c8
call fcn.14005a244
test eax, eax
je 0x14005a999
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.14005a2dc
mov rbx, qword [rbp + 0x30]
test eax, eax
js 0x14005a974
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFveDetect
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14005a974
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x18]
mov rcx, qword [rbp + 0x28]
lea rdx, str.Cache
mov qword [rsp + 0x38], rax
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14005a974
mov rcx, qword [rbp + 0x18]
lea r9d, [rax + 4]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test rbx, rbx
je 0x14005a999
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14005a9b3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp + 0x18], 0
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14005a9c8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x14005afd0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x1400af760], rbx
je 0x14005b037
cmp rax, rbx
jne 0x14005b02a
mov ebx, 1
mov esi, ebx
jmp 0x14005b03c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14005b00f
mov ebx, 1
mov eax, dword [0x1400af768]
cmp eax, ebx
jne 0x14005b054
mov edi, AtlInternalQueryInterface
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14005b0c0
mov eax, dword [0x1400af768]
test eax, eax
jne 0x14005b0b5
mov dword [0x1400af768], ebx
lea r15, [0x140062ee0]
lea rdi, [0x140062ec8]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14005b0a7
test eax, eax
jne 0x14005b0ab
cmp qword [rdi], r14
je 0x14005b09c
mov rax, qword [rdi]
mov rcx, qword [0x140062e08]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14005b07e
test eax, eax
je 0x14005b0bb
mov eax, 0xff
jmp 0x14005b216
mov dword [0x1400ae8a4], ebx
mov edi, AtlInternalQueryInterface
mov eax, dword [0x1400af768]
cmp eax, ebx
jne 0x14005b0e7
lea rdx, [0x140062ec0]
lea rcx, [0x140062e10]
call sub.msvcrt.dll__initterm
mov dword [0x1400af768], 2
test esi, esi
jne 0x14005b0f5
mov rax, r14
xchg qword [0x1400af760], rax
cmp qword [0x1400af780], r14
je 0x14005b128
lea rcx, [0x1400af780]
call fcn.14005b820
test eax, eax
je 0x14005b128
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400af780]
mov r9, qword [0x140062e08]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14005b141
mov eax, 0xff
jmp 0x14005b216
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14005b1c7
test ax, ax
je 0x14005b15c
test edx, edx
jne 0x14005b1c7
sub ax, bx
cmp ax, di
ja 0x14005b172
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14005b15c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140007150
mov dword [0x1400ae8a0], eax
cmp dword [0x1400ae8c0], r14d
jne 0x14005b1b0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400ae8a4], r14d
jne 0x14005b1c5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400ae8a0]
jmp 0x14005b216
cmp ax, 0x22
jne 0x14005b1db
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14005b14a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140142000
add rsp, 0x28
jmp 0x14005afd0
Function at 0x14005b70c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005b758
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005b750
cmp dword [rcx + 0x3c], edx
jl 0x14005b750
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14005b750
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14005b758
mov rax, rdx
add rsp, 0x18
ret
Function at 0x10000f87c
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x890
mov rax, qword [0x10003a170]
xor rax, rsp
mov qword [rsp + 0x880], rax
cmp dword [0x10003b0d0], 0
je 0x10000f9fb
cmp ecx, 1
jb 0x10000f9fb
lea rdx, [0x100001c30]
lea rcx, [r11 - 0x428]
lea rbx, [r11 + 0x18]
call qword [sym.imp.msvcrt.dll_sprintf]
mov rdx, qword [rsp + 0x8b8]
xor eax, eax
or rbp, 0xffffffffffffffff
lea rdi, [rsp + 0x480]
mov r8, rbx
mov rcx, rbp
repne scasb al, byte [rdi]
not rcx
lea rcx, [rsp + rcx + 0x47f]
call qword [sym.imp.msvcrt.dll_vsprintf]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x10003b0d0], 3
jne 0x10000f9fb
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x418
mov byte [rsp + 0x60], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x5e]
movzx ecx, word [rsp + 0x5a]
movzx eax, word [rsp + 0x5c]
movzx edi, word [rsp + 0x58]
movzx r10d, word [rsp + 0x56]
movzx r9d, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rdx, [0x100001c40]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r10d
call qword [sym.imp.msvcrt.dll_sprintf]
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, rbp
repne scasb al, byte [rdi]
lea rcx, [rsp + 0x480]
xor edx, edx
mov al, byte [rcx + rdx]
add rdx, 1
test al, al
mov byte [rdi + rdx - 2], al
jne 0x10000f9a4
lea rdx, [0x100001c68]
lea rcx, [0x100001c70]
call qword [sym.imp.msvcrt.dll_fopen]
lea rdi, [rsp + 0x60]
mov rcx, rbp
mov rbx, rax
xor eax, eax
repne scasb al, byte [rdi]
lea r8d, [rax + 1]
mov r9, rbx
not rcx
sub rcx, 1
movsxd rdx, ecx
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.100033800
add rsp, 0x890
pop rdi
pop rbp
pop rbx
ret
Function at 0x10000fa1c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x7e0
mov rax, qword [0x10003a170]
xor rax, rsp
mov qword [rsp + 0x7d0], rax
lea rax, [rsp + 0x70]
mov r13, r9
mov rbp, r8
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x1ec
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov rbx, rcx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
lea r8d, [r14 + 1]
xor r9d, r9d
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 1
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp rax, r14
mov rsi, rax
je 0x10000fb87
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x64]
lea rdx, [rsp + 0x2e0]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x68], 0x80
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x64], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, r14d
jne 0x10000fb00
mov eax, dword [rsp + 0x64]
mov byte [rsp + rax + 0x2e0], r14b
mov edi, r14d
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x260]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov edx, edi
mov rcx, rsi
mov dword [rsp + 0x60], 0x400
mov dword [r13], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, r14d
mov r12d, eax
jne 0x10000fb72
mov eax, dword [rsp + 0x60]
lea rdx, [0x100001c98]
lea rcx, [rsp + 0x260]
mov dword [r13], eax
mov bl, r14b
call qword [sym.imp.msvcrt.dll__mbsicmp]
cmp eax, r14d
je 0x10000fbab
add edi, 1
cmp r12d, 0x103
jne 0x10000fb03
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x7d0]
xor rcx, rsp
call fcn.100033800
add rsp, 0x7e0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [rsp + 0x60]
cmp eax, r14d
jbe 0x10000fbc9
mov rcx, rax
add bl, byte [rbp]
add rbp, 1
sub rcx, 1
jne 0x10000fbb7
cmp bl, r14b
jne 0x10000fb7e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x10000fb89
Function at 0x10000fef4
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1300
call fcn.100034700
sub rsp, rax
mov rax, qword [0x10003a170]
xor rax, rsp
mov qword [rsp + 0x12f0], rax
mov rdi, rcx
test r8, r8
lea rax, [0x100001fd0]
mov qword [rcx], rax
lea rcx, [0x100002ce4]
mov ebx, reloc.WS2_32.dll_recv
mov rax, rcx
mov qword [rdi + 8], rcx
mov dword [rdi + 0x58], 1
cmovne rax, r8
test r9, r9
mov dword [rdi + 0x70], 0xf01ff
cmovne rcx, r9
and dword [rdi + 0x20], 0
and dword [rdi + 0x24], 0
and dword [rdi + 0x28], 0
and qword [rdi + 0x48], 0
and qword [rdi + 0x60], 0
and dword [rdi + 0x6c], 0
and dword [rdi + 0x88], 0
and qword [rdi + 0x90], 0
and qword [rdi + 0x98], 0
and qword [rdi + 0xa0], 0
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rcx
lea rax, [0x100002cd8]
lea rcx, [rsp + 0x50]
mov dword [rdi + 0x74], ebx
mov dword [rdi + 0x78], 2
mov dword [rdi + 0x7c], 1
mov qword [rdi + 0x80], rax
mov dword [rsp + 0x50], DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor r11d, r11d
cmp dword [rsp + 0x60], 2
mov dword [0x10003b0d4], 1
sete r11b
and dword [rdi + 0x3c], 0
mov qword [0x10003b0d8], rdi
test r11d, r11d
mov dword [rdi + 0x68], r11d
mov dword [rdi + 0x2c], ebx
je 0x1000100df
mov eax, 0xff
lea rcx, [rsp + 0xf0]
xor edx, edx
lea ebx, [rax + 1]
mov dword [rsp + 0x48], 0x1000
mov dword [rsp + 0x44], eax
mov r8, rbx
mov dword [rsp + 0x40], eax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1f0]
mov r8, rbx
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x2f0]
xor edx, edx
mov r8d, 0x1000
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r11, [rsp + 0x4c]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x2f0]
lea rdx, [rsp + 0xf0]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x1000100df
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1000100df
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
mov ebx, eax
call fcn.1000331d0
lea r8, [rsp + 0x2f0]
mov ecx, ebx
mov rdx, rax
mov qword [rdi + 0x60], rax
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov rax, rdi
mov rcx, qword [rsp + 0x12f0]
xor rcx, rsp
call fcn.100033800
mov rbx, qword [rsp + 0x1318]
add rsp, 0x1300
pop rdi
ret
Function at 0x100010d40
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x10003a170]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movdqu xmm6, xmmword [rdx]
xor edx, edx
mov rdi, r8
mov rbx, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x20]
movdqu xmmword [rsp + 0x40], xmm6
call sub.msvcrt.dll_memset
cmp dword [rsp + 0x40], 0
mov eax, 5
movdqu xmmword [rsp + 0x2c], xmm6
lea r8d, [rax - 4]
lea rdx, [rsp + 0x20]
mov rcx, rbx
cmove r8d, eax
mov dword [rsp + 0x20], 0x20
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_RegisterDeviceNotificationA]
test rax, rax
mov qword [rdi], rax
jne 0x100010de9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100001ee0]
lea rcx, [rsp + 0x50]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x100010dee
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.100033800
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret

Function at 0x1000119a8
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov dword [r11 + 0x18], r8d
push rdi
sub rsp, 0x50
xor ebx, ebx
lea rax, [r11 + 8]
mov rsi, rdx
mov qword [r11 - 0x18], rbx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbx
lea rdx, [rcx + 0x10]
mov rcx, qword [rcx + 8]
lea r9, [0x100001a3d]
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
or edi, 0xffffffff
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x100011a2d
mov rcx, qword [rsp + 0x60]
lea r9d, [rdi + 5]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x78]
cmp edi, ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x100011a78
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x180
mov rax, qword [0x10003a170]
xor rax, rsp
mov qword [rsp + 0x170], rax
and dword [rsp + 0x30], 0
lea rax, [0x1000020c8]
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xffffffff80000002
xor ecx, ecx
lea rax, [0x1000020a8]
mov al, byte [rcx + rax]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0x5f], al
jne 0x100011ab4
xor eax, eax
or rdx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
mov rcx, rdx
mov r9d, 0x20019
xor r8d, r8d
repne scasb al, byte [rdi]
movzx eax, word [0x100002090]
mov rcx, rdx
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
mov rax, qword [0x100002098]
lea rdx, [rsp + 0x60]
mov qword [rdi - 1], rax
mov eax, dword [0x1000020a0]
mov dword [rsp + 0x38], 4
mov dword [rdi + 7], eax
movzx eax, word [0x1000020a4]
mov word [rdi + 0xb], ax
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100011b76
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
lea rdx, [0x1000020b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsp + 0x30]
lea rdx, [0x1000020b8]
lea rcx, [rsp + 0x50]
call fcn.1000119a8
xor edx, edx
lea rcx, [rsp + 0x34]
cmp dword [rsp + 0x30], edx
lea r8d, [rdx + 3]
jne 0x100011ba1
lea r8d, [rdx + 1]
call qword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeA]
test eax, eax
je 0x100011baf
xor al, al
jmp 0x100011bc0
mov ecx, dword [rsp + 0x34]
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_CM_Reenumerate_DevNode]
test eax, eax
sete al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.100033800
add rsp, 0x180
pop rdi
ret
Function at 0x1000121d8
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xd60
mov rax, qword [0x10003a170]
xor rax, rsp
mov qword [rsp + 0xd50], rax
mov r14, r9
mov r13, r8
mov r12d, edx
lea rsi, [rcx + 0x368]
lea rbx, [rcx + 0x268]
mov ebp, 0x20
mov rcx, qword [rbx]
test rcx, rcx
je 0x100012302
mov r8d, dword [rsi]
test r8d, r8d
jne 0x10001225e
mov r9, r14
mov r8, r13
mov edx, r12d
call qword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
jne 0x100012302
mov r8, qword [rbx]
lea rdx, [0x100002cf0]
lea ecx, [rax + 1]
call fcn.10000f87c
and qword [rbx], 0
jmp 0x100012302
lea rdx, [0x100002d10]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r9, qword [rbx]
mov qword [rsp + 0x30], r14
lea r8, [0x100002d28]
lea rdx, [0x100002d38]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
call qword [sym.imp.msvcrt.dll_sprintf]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
and dword [rsp + 0x30], eax
repne scasb al, byte [rdi]
lea rax, [rsp + 0x40]
not rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x950]
mov r8d, ecx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4d0]
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
jne 0x100012302
mov r9d, dword [rsi]
mov r8, qword [rbx]
lea rdx, [0x100002d48]
lea ecx, [rax + 1]
call fcn.10000f87c
and qword [rbx], 0
and dword [rsi], 0
add rbx, 8
add rsi, 4
sub rbp, 1
jne 0x100012218
lea eax, [rbp + 1]
mov rcx, qword [rsp + 0xd50]
xor rcx, rsp
call fcn.100033800
add rsp, 0xd60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret