joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080960
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0x6c], rax
mov ebx, ecx
mov dword [rsp + 0x74], eax
movups xmmword [rsp + 0x2c], xmm0
movups xmmword [rsp + 0x3c], xmm0
movups xmmword [rsp + 0x4c], xmm0
movups xmmword [rsp + 0x5c], xmm0
cmp ecx, 0x65
jne 0x14008099f
mov rdi, qword [0x14018ec80]
jmp 0x1400809bd
cmp ebx, 0x66
jne 0x1400809ad
mov rdi, qword [0x14018ec88]
jmp 0x1400809bd
cmp ebx, 0x68
jne 0x140080acd
mov rdi, qword [0x14018ec90]
mov r9d, 2
mov edx, 0x100c
mov rcx, rdi
lea r8, [r9 - 3]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x140080acd
lea r9, [rsp + 0x20]
mov dword [rsp + 0x24], eax
xor r8d, r8d
mov dword [rsp + 0x28], 0
mov edx, 0x104b
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x140080acd
cmp ebx, 0x65
jne 0x140080a3a
mov rbx, qword [rsp + 0x48]
mov rcx, qword [0x140189c20]
mov r8, rbx
mov edx, dword [rbx + 0x24]
call fcn.140086170
mov rcx, rbx
call fcn.1400c28b0
jmp 0x140080acd
cmp ebx, 0x66
jne 0x140080a4e
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400c25f0
jmp 0x140080acd
cmp ebx, 0x68
jne 0x140080acd
mov r8, qword [rsp + 0x48]
test byte [r8 + 0x100], 8
je 0x140080a83
mov rcx, qword [0x14018ec80]
lea r9d, [rbx - 0x58]
lea r8, str.Process_Explorer_Error
lea rdx, str.Properties_not_supported_on_pagefile_backed_sections
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140080acd
cmp qword [r8 + 0x118], 0
jne 0x140080ab0
mov rcx, qword [0x14018ec78]
lea r8, [0x14011f590]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, str.Not_a_valid_DLL
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140080acd
lock inc dword [r8 + 0x20]
mov eax, dword [0x140170720]
lea rcx, [0x1400c28d0]
xor edx, edx
mov dword [r8 + 0x24], eax
call fcn.1400f7c20
mov rbx, qword [rsp + 0x90]
xor eax, eax
add rsp, 0x80
pop rdi
ret

Function at 0x140085c40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call fcn.140085c90
test al, al
je 0x140085c76
mov rcx, qword [0x14018e720]
mov r8d, ebx
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_GetWindowTextW]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140085c90
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp byte [reloc.ACLUI.dll_CreateSecurityPage], 0
jne 0x140085ccc
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x248
ret
mov qword [rsp + 0x240], rbx
xor bl, bl
cmp qword [0x14018e720], 0
je 0x140085d59
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400e36c0
mov rcx, qword [0x14018e720]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x140085d59
lea r9, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
lea r10, str._Filter_by_name_
movzx r8d, word [r9 + rcx*2 + 2]
movzx eax, word [r10 + rcx*2 + 2]
sub r8d, eax
jne 0x140085d4b
add rcx, 2
cmp rcx, 0x11
je 0x140085d4b
movzx r8d, word [r9 + rcx*2]
movzx edx, word [r10 + rcx*2]
sub r8d, edx
je 0x140085d21
test r8d, r8d
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x248
ret

Function at 0x140087010
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140098ce0
push rdi
sub rsp, 0x20
cmp byte [0x14018df9c], 0
mov rdi, rcx
je 0x140098d06
mov rcx, qword [0x14018ec78]
call fcn.14008d8b0
xor eax, eax
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14018ec78]
mov dl, 1
call fcn.1400840b0
mov ebx, 1
mov edx, ebx
mov rcx, rdi
call fcn.14008e6e0
inc ebx
cmp ebx, 8
jl 0x140098d26
mov rcx, qword [0x14018f248]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor edx, edx
lea rcx, [0x140189740]
call fcn.140095280
mov rcx, qword [0x14018f240]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400878b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, r9
mov rbp, r8
mov r14d, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
lea rcx, [0x1401a9580]
call fcn.140086780
xor r15d, r15d
lea r10, [rdi + 0x68]
test rdi, rdi
mov rbx, rax
mov ecx, r15d
mov edx, dword [rax + 0x10]
cmove r10, r15
test edx, edx
jle 0x140087995
mov rax, qword [rax + 8]
nop dword [rax + rax]
cmp qword [rax], r10
je 0x140087921
inc ecx
add rax, 8
cmp ecx, edx
jl 0x140087910
jmp 0x140087995
test ecx, ecx
js 0x140087995
cmp ecx, edx
jge 0x140087995
lea eax, [rdx - 1]
cmp ecx, eax
je 0x140087992
sub edx, ecx
movsxd rcx, ecx
lea eax, [rdx - 1]
movsxd r8, eax
mov rax, qword [rbx + 8]
shl r8, 3
lea rcx, [rax + rcx*8]
lea r9, [rcx + 8]
test r8, r8
je 0x140087992
test rcx, rcx
jne 0x140087965
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
jmp 0x140087a6a
test r9, r9
jne 0x14008797a
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
jmp 0x140087a6a
movsxd rax, edx
shl rax, 3
cmp rax, r8
jb 0x140087a5f
mov rdx, r9
call fcn.1400e3010
dec dword [rbx + 0x10]
mov edx, dword [rbx + 0x20]
lea r8, [rdi + 0x70]
test rdi, rdi
mov ecx, r15d
cmove r8, r15
test edx, edx
jle 0x140087a2d
mov rax, qword [rbx + 0x18]
cmp qword [rax], r8
je 0x1400879c3
inc ecx
add rax, 8
cmp ecx, edx
jl 0x1400879b2
jmp 0x140087a2d
test ecx, ecx
js 0x140087a2d
cmp ecx, edx
jge 0x140087a2d
lea eax, [rdx - 1]
cmp ecx, eax
je 0x140087a2a
sub edx, ecx
movsxd rcx, ecx
lea eax, [rdx - 1]
movsxd r8, eax
mov rax, qword [rbx + 0x18]
shl r8, 3
lea rcx, [rax + rcx*8]
lea r9, [rcx + 8]
test r8, r8
je 0x140087a2a
test rcx, rcx
jne 0x140087a04
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
jmp 0x140087a6a
test r9, r9
jne 0x140087a16
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
jmp 0x140087a6a
movsxd rax, edx
shl rax, 3
cmp rax, r8
jb 0x140087a5f
mov rdx, r9
call fcn.1400e3010
dec dword [rbx + 0x20]
mov rax, qword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov edx, r14d
mov dword [rax], r15d
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp 0x140098db0
call fcn.1400e864c
mov dword [rax], 0x22
call fcn.1400e8140
mov ecx, 0x80070057
call fcn.140032b30
int3
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14018ec78]
mov dl, 1
call fcn.1400840b0
mov ebx, 1
nop dword [rax + rax]
mov edx, ebx
mov rcx, rdi
call fcn.14008e6e0
inc ebx
cmp ebx, 8
jl 0x140098de0
mov rcx, qword [0x14018f248]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor edx, edx
lea rcx, [0x140189740]
call fcn.140095280
mov rcx, qword [0x14018f240]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140089a10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x470
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov esi, edx
lea rbx, [rcx + 2]
mov rdi, rcx
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSysinternalsProcess_Explorer
lea r14d, [rsi - 2]
lea eax, [r14 + r14]
mov dword [rsp + 0x30], eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140089a98
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.OriginalPath
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140089aa6
mov r8d, r14d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140089ab6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx r8d, word [rbx]
lea rdx, [0x140133318]
lea rcx, [rsp + 0x40]
call fcn.1400888e0
lea r8, [rsp + 0x34]
mov dword [rsp + 0x34], 0x208
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x140089b0e
lea r8, [rdi + 4]
mov edx, 0x208
lea rcx, [rsp + 0x50]
call fcn.1400f7f64
lea edx, [rsi - 1]
mov rcx, rbx
lea r8, [rsp + 0x50]
call fcn.1400e86e4
mov eax, 0x22
lea r8, [0x140125380]
mov rdx, rsi
mov word [rdi], ax
mov rcx, rdi
call fcn.1400f7f64
mov rdx, rsi
mov rcx, rdi
call fcn.1400e926c
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x470
pop r14
pop rdi
pop rsi
ret

Function at 0x140089b60
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor ebx, ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rsi, rdx
mov dword [rsp + 0x50], ebx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140089c11
mov ecx, dword [rsp + 0x50]
mov qword [rsp + 0x40], rdi
call fcn.1400e8270
mov rdi, rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140089c04
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x50], eax
test eax, eax
je 0x140089c04
mov ecx, eax
add rcx, rcx
call fcn.1400e8270
mov r8d, dword [rsp + 0x50]
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
call fcn.1400e825c
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
Function at 0x14008a7c0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x450], rax
movzx edi, cl
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x410
call fcn.1400e36c0
mov edx, 0x208
lea rcx, [rsp + 0x40]
call fcn.140089a10
cmp dword [0x1401896c8], 1
jl 0x14008a821
lea rdx, [rsp + 0x40]
movzx ecx, dil
call fcn.140088940
mov ebx, eax
jmp 0x14008a8e7
lea rax, [rsp + 0x30]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14008a8e7
test dil, dil
je 0x14008a8c0
lea r8, [0x1401337b0]
mov edx, 0x208
lea rcx, [rsp + 0x40]
call fcn.1400f7f64
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14008a880
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x14011f590]
lea rax, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x14008a8dc
mov rcx, qword [rsp + 0x30]
lea rdx, [0x14011f590]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
xor eax, eax
cmp ebx, 2
cmove ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14008a908
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [0x14018ec78]
lea rcx, str.Error_configuring_auto_start
call fcn.1400c56e0
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret
Function at 0x14008aa80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008aac2
mov r8, rsi
mov edx, 0x104
mov rcx, rbp
call fcn.1400e86e4
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], r14
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x14008aad0
add eax, ebx
mov qword [rsp + 0x48], r15
movsxd r14, eax
add r14, 2
lea rcx, [r14 + r14]
call fcn.1400e8270
mov rbx, rax
test rdi, rdi
je 0x14008ab73
xor r15d, r15d
nop dword [rax]
cmp word [rdi], r15w
je 0x14008ab73
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.1400e86e4
mov edx, 0x3b
mov rcx, rbx
call fcn.1400e3bac
test rax, rax
je 0x14008ab2a
mov word [rax], r15w
lea r8, [0x14011eb8c]
mov rdx, r14
mov rcx, rbx
call fcn.1400f7f64
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.1400f7f64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008ab9e
mov edx, 0x3b
mov rcx, rdi
call fcn.1400e3bac
mov rdi, rax
test rax, rax
je 0x14008ab73
add rdi, 2
jne 0x14008ab00
xor dil, dil
mov edx, 2
mov rcx, rbx
call fcn.1400e0fb8
mov r15, qword [rsp + 0x48]
movzx eax, dil
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r8, rbx
mov edx, 0x104
mov rcx, rbp
call fcn.1400e86e4
mov dil, 1
jmp 0x14008ab76
Function at 0x14008abc0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1040
call fcn.1400e1740
sub rsp, rax
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov esi, ecx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
xor edx, edx
xor edi, edi
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x14008acdd
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x20], esi
jne 0x14008acc0
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14008ac42
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14008acc0
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14008ac6a
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [rsp + 0x4c]
sub eax, dword [rsp + 0x44]
cmp eax, 1
jle 0x14008acc0
mov r8d, 0x7e8
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x14008acc0
mov rcx, rbx
mov rdi, rbx
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x14008acdd
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x14008acc0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14008acdd
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
jne 0x14008ac10
mov rax, rdi
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400e17a0
lea r11, [rsp + 0x1040]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14008ae40
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbx, qword [0x14018e760]
mov rbp, r9
mov r14, rdx
mov rsi, rcx
test rbx, rbx
je 0x14008ae90
nop word [rax + rax]
mov rcx, qword [rbx]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14008af5d
mov rbx, qword [rbx + 0x418]
test rbx, rbx
jne 0x14008ae70
lea rax, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x80]
lea rax, [rsp + 0x90]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea rcx, [0x14011eaa0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x14008af96
mov ecx, 0x420
mov qword [rsp + 0x70], rdi
call fcn.1400e8270
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, eax
call fcn.1400e8270
mov rcx, rsi
mov qword [rdi], rax
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov r8, rsi
mov rdx, rbx
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_CopySid]
lea rcx, [rdi + 8]
mov r8, r14
mov edx, 0x104
call fcn.1400e86e4
lea rcx, [rdi + 0x210]
mov r8, rbp
mov edx, 0x104
call fcn.1400e86e4
mov rax, qword [0x14018e760]
mov qword [rdi + 0x418], rax
mov al, 1
mov qword [0x14018e760], rdi
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
mov edx, dword [rsp + 0x80]
lea r8, [rbx + 8]
mov rcx, r14
call fcn.1400e86e4
mov edx, dword [rsp + 0x90]
lea r8, [rbx + 0x210]
mov rcx, rbp
call fcn.1400e86e4
mov al, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x78]
xor al, al
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
Function at 0x14008bb10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, 0xffffffffffffffff
mov rdx, rax
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x14008bb51
lea rcx, [rsp + 0x30]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14008bb60
lea rsi, [rax + 0x13]
add rsi, rdx
lea rcx, [rsi + rsi]
call fcn.1400e8270
mov edx, 0x5c
lea rcx, [rsp + 0x36]
mov rdi, rax
call fcn.1400e3bac
xor ecx, ecx
lea rdx, str.SystemRoot_
mov word [rax], cx
lea r8d, [rcx + 0xc]
mov rcx, rbx
call fcn.1400e8bbc
test eax, eax
jne 0x14008bbc4
lea edx, [rax + 0x5c]
lea rcx, [rbx + 2]
call fcn.1400e3bac
mov qword [rsp + 0x20], rax
lea r8, str._s_s
jmp 0x14008bc1a
mov r8d, 4
lea rdx, [0x14011f338]
mov rcx, rbx
call fcn.1400e8940
test eax, eax
jne 0x14008bbee
lea r8, [rbx + 8]
mov rdx, rsi
mov rcx, rdi
call fcn.1400e86e4
jmp 0x14008bc2a
cmp word [rbx], 0x5c
mov qword [rsp + 0x20], rbx
jne 0x14008bc13
movzx r9d, word [rsp + 0x30]
lea r8, str._c:_s
mov rdx, rsi
mov rcx, rdi
call fcn.1400192b0
jmp 0x14008bc2a
lea r8, str._sSystem32Drivers_s
lea r9, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call fcn.1400192b0
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400e17a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14008bc60
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov r15, rdx
mov r12, rcx
lea r8, [0x14011eaa0]
mov rdx, r14
mov rcx, r15
mov rdi, r9
call fcn.1400e86e4
mov rsi, qword [rsp + 0x70]
lea rdx, [rsp + 0x68]
xor eax, eax
mov rcx, r12
mov qword [rdi], rax
mov qword [rsi], rax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
jne 0x14008bcc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rcx, rbp
mov qword [rsp + 0x50], rbx
call fcn.1400e8270
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r12
mov rbx, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14008bd62
mov edx, dword [rbx + 0x30]
mov r9, r14
mov ecx, dword [rbx + 0x34]
mov r8, r15
call fcn.1400a8720
lea rdx, [0x14011f4f8]
mov rcx, rbx
call fcn.1400ab6a0
test rax, rax
jne 0x14008bd24
lea rdx, str.ProductDescription
mov rcx, rbx
call fcn.1400ab6a0
test rax, rax
je 0x14008bd2f
mov rcx, rax
call fcn.1400e81d8
mov qword [rdi], rax
lea rdx, [0x14011f518]
mov rcx, rbx
call fcn.1400ab6a0
test rax, rax
jne 0x14008bd57
lea rdx, [0x140133288]
mov rcx, rbx
call fcn.1400ab6a0
test rax, rax
je 0x14008bd62
mov rcx, rax
call fcn.1400e81d8
mov qword [rsi], rax
mov rcx, rbx
call fcn.1400e825c
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14008dbd0
Capabilities:
Persist via image file execution options registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x450], rax
movzx ebx, dl
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x410
call fcn.1400e36c0
mov edx, 0x208
lea rcx, [rsp + 0x40]
call fcn.140089a10
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14008dc99
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14008dc40
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x140124b48]
lea rax, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14008dc95
test bl, bl
je 0x14008dcb8
mov ecx, edi
jmp 0x14008dc9f
mov al, 1
jmp 0x14008dcba
test bl, bl
je 0x14008dcb8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [0x14018ec78]
lea rcx, str.Error_replacing_Task_Manager
call fcn.1400c56e0
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rdi
ret
Function at 0x14008df10
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x4b0
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov ebx, edx
mov rdi, rcx
mov edx, 0x208
lea rcx, [rsp + 0x90]
movzx esi, r8b
call fcn.140089a10
xorps xmm0, xmm0
lea rax, str.Runas
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], WSAStartup
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x24], 0x40
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x50], ebx
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x40], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14008dfca
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14008dff2
test sil, sil
je 0x14008dfe2
mov rcx, qword [rsp + 0x88]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400e17a0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret