joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009f20
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r13, rdx
mov r15d, r8d
xor edx, edx
mov rax, rcx
div r15
mov rbp, rcx
sub rbp, rdx
sub rbp, r15
cmp rbp, r13
jb 0x18000a14d
mov ecx, dword [0x180014820]
mov rax, qword gs:[0x58]
mov r12d, 0x2ac
mov esi, 0x148
add rsi, qword [rax + rcx*8]
add r12, qword [rax + rcx*8]
mov r14, rsi
xor ecx, ecx
nop dword [rax]
mov eax, dword [r12]
test al, 1
jne 0x180009ff7
movups xmm0, xmmword [0x180012228]
or eax, 1
mov dword [r14 + 8], ecx
mov dword [r12], eax
mov r8, r14
mov eax, dword [0x180012238]
mov edx, ecx
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x30]
xor eax, eax
mov qword [r14], 0
mov byte [r14 + 0xc], 0
mov dword [r14 + 0x10], eax
lea rax, [rsp + 0x30]
sub r8, rax
movaps xmmword [rsp + 0x20], xmm0
nop dword [rax]
mov eax, dword [rcx]
inc edx
mov dword [rcx + r8 + 0x10], eax
lea rcx, [rcx + 4]
cmp edx, 1
jb 0x180009fe0
mov rsi, r14
xor ecx, ecx
cmp byte [rsi + 0xc], 0
jne 0x18000a05e
mov r9d, ecx
lea rcx, [rsi + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rsi + 4]
mov edx, dword [rsi]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x18000a044
lea r8d, [rax + 2]
cmp edx, r8d
je 0x18000a044
cmp edx, eax
je 0x18000a04b
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x18000a03d
add eax, 3
xor dword [rcx], eax
inc dword [rsi]
jmp 0x18000a010
add eax, 5
cmp edx, eax
jne 0x18000a051
xor dword [rcx], r8d
inc dword [rsi]
jmp 0x18000a010
lea eax, [r9 + 0x33]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x18000a010
mov eax, dword [rsi + 0x10]
mov byte [rsi + 0xc], 1
mov rcx, qword gs:[rax]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18000a0f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18000a0f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x5b1835f7
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18000a0f2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x10dbd33
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18000a0d0
cmp r8d, 0x486bbafe
je 0x18000a0fc
test r9d, r9d
jne 0x18000a0b0
mov rax, qword [rax]
jmp 0x18000a080
mov ecx, dword [rbx + 0x24]
mov r8d, 0x30
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x40]
add rax, r10
mov rcx, rbp
call rax
test rax, rax
je 0x18000a14d
cmp dword [rsp + 0x60], 0x10000
je 0x18000a177
mov rbp, qword [rsp + 0x48]
cmp rbp, r15
jb 0x18000a14d
sub rbp, r15
mov ecx, 0
cmp rbp, r13
jae 0x180009f90
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180010210
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, rbp
jmp 0x18000a14f
Function at 0x18000a180
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r13, rdx
mov r12d, r8d
xor edx, edx
mov ebp, r8d
mov rax, rcx
mov dword [rsp + 0x20], r8d
div r12
sub rbp, rdx
add rbp, rcx
cmp rbp, r13
ja 0x18000a3bb
mov ecx, dword [0x180014820]
mov rax, qword gs:[0x58]
mov r15d, 0x2ac
mov esi, 0x148
add rsi, qword [rax + rcx*8]
add r15, qword [rax + rcx*8]
mov r14, rsi
xor ecx, ecx
mov eax, dword [r15]
test al, 1
jne 0x18000a257
movups xmm0, xmmword [0x180012228]
or eax, 1
mov dword [r14 + 8], ecx
mov dword [r15], eax
mov r8, r14
mov eax, dword [0x180012238]
mov edx, ecx
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x40]
xor eax, eax
mov qword [r14], 0
mov byte [r14 + 0xc], 0
mov dword [r14 + 0x10], eax
lea rax, [rsp + 0x40]
sub r8, rax
movaps xmmword [rsp + 0x30], xmm0
mov eax, dword [rcx]
inc edx
mov dword [rcx + r8 + 0x10], eax
lea rcx, [rcx + 4]
cmp edx, 1
jb 0x18000a240
mov rsi, r14
xor ecx, ecx
cmp byte [rsi + 0xc], 0
jne 0x18000a2be
mov r9d, ecx
lea rcx, [rsi + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rsi + 4]
mov edx, dword [rsi]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x18000a2a4
lea r8d, [rax + 2]
cmp edx, r8d
je 0x18000a2a4
cmp edx, eax
je 0x18000a2ab
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x18000a29d
add eax, 3
xor dword [rcx], eax
inc dword [rsi]
jmp 0x18000a270
add eax, 5
cmp edx, eax
jne 0x18000a2b1
xor dword [rcx], r8d
inc dword [rsi]
jmp 0x18000a270
lea eax, [r9 + 0x33]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x18000a270
mov eax, dword [rsi + 0x10]
mov byte [rsi + 0xc], 1
mov rcx, qword gs:[rax]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18000a357
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18000a357
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x815f4c12
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18000a352
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x10dbd33
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18000a330
cmp r8d, 0x6bc4935f
je 0x18000a35c
test r9d, r9d
jne 0x18000a310
mov rax, qword [rax]
jmp 0x18000a2e0
mov ecx, dword [rbx + 0x24]
mov r8d, 0x30
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x50]
add rax, r10
mov rcx, rbp
call rax
test rax, rax
je 0x18000a3bb
cmp dword [rsp + 0x70], 0x10000
je 0x18000a3e8
mov ebp, dword [rsp + 0x20]
xor edx, edx
dec ebp
mov ecx, 0
add rbp, qword [rsp + 0x68]
add rbp, qword [rsp + 0x50]
mov rax, rbp
div r12
sub rbp, rdx
cmp rbp, r13
jbe 0x18000a1f5
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180010210
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, rbp
jmp 0x18000a3bd
Function at 0x18000aaa0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x48
mov r11, qword [0x1800148a8]
xor r8d, r8d
mov rax, rcx
mov edx, r8d
and rax, 0xfffffffffffff000
test r11, r11
je 0x18000acc0
cmp r11, rax
je 0x18000aad8
mov rdx, r11
mov r11, qword [r11]
test r11, r11
jne 0x18000aac3
add rsp, 0x48
ret
mov rax, qword [r11 + 8]
mov qword [rcx], rax
add dword [r11 + 0x10], 0xffffffff
mov qword [r11 + 8], rcx
jne 0x18000acc0
mov rax, qword [r11]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rdi
test rdx, rdx
je 0x18000ab0a
mov qword [rdx], rax
jmp 0x18000ab11
mov qword [0x1800148a8], rax
mov ecx, dword [0x180014820]
mov rax, qword gs:[0x58]
mov r10d, 0x148
mov rbx, qword [rax + rcx*8]
mov ecx, 0x2ac
mov eax, dword [rcx + rbx]
test al, 1
jne 0x18000ab92
movups xmm0, xmmword [0x180012228]
or eax, 1
mov qword [rbx + r10], r8
lea r9, [rbx + r10]
mov dword [rcx + rbx], eax
mov eax, dword [0x180012238]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov edx, r8d
xor eax, eax
mov dword [r9 + 8], r8d
mov byte [r9 + 0xc], r8b
mov dword [r9 + 0x10], eax
lea rax, [rsp + 0x30]
sub r9, rax
movaps xmmword [rsp + 0x20], xmm0
nop dword [rax + rax]
mov eax, dword [rcx]
inc edx
mov dword [rcx + r9 + 0x10], eax
lea rcx, [rcx + 4]
cmp edx, 1
jb 0x18000ab80
cmp byte [rbx + r10 + 0xc], r8b
jne 0x18000abf6
lea rcx, [r10 + 0x10]
add rcx, rbx
mov eax, dword [rbx + r10 + 4]
mov edx, dword [rbx + r10]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x18000abda
lea r9d, [rax + 2]
cmp edx, r9d
je 0x18000abda
cmp edx, eax
je 0x18000abe3
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x18000abd3
add eax, 3
xor dword [rcx], eax
inc dword [rbx + r10]
jmp 0x18000aba0
add eax, 5
cmp edx, eax
jne 0x18000abe9
xor dword [rcx], r9d
inc dword [rbx + r10]
jmp 0x18000aba0
lea eax, [r8 + 0x33]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x18000aba0
mov eax, dword [rbx + r10 + 0x10]
mov byte [rbx + r10 + 0xc], 1
mov rcx, qword gs:[rax]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x18000ac87
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x18000ac87
mov esi, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb813cf86
lea rcx, [rsi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18000ac82
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x10dbd33
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18000ac60
cmp r8d, 0xa60065db
je 0x18000ac8c
test r9d, r9d
jne 0x18000ac40
mov rax, qword [rax]
jmp 0x18000ac10
mov edx, dword [rdi + 0x24]
mov rcx, r11
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
xor edx, edx
add rax, r10
mov r8d, 0x8000
call rax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x18000acd0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword gs:[0x58]
mov rsi, rcx
mov ecx, dword [0x180014820]
mov r10d, 0x148
mov r11, qword [rax + rcx*8]
mov ecx, 0x2ac
mov eax, dword [rcx + r11]
test al, 1
jne 0x18000ad82
movups xmm0, xmmword [0x180012228]
or eax, 1
mov qword [r11 + r10], 0
lea r8, [r11 + r10]
mov dword [rcx + r11], eax
mov eax, dword [0x180012238]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
xor edx, edx
xor eax, eax
mov dword [r8 + 8], 0
mov byte [r8 + 0xc], 0
mov dword [r8 + 0x10], eax
lea rax, [rsp + 0x30]
sub r8, rax
movaps xmmword [rsp + 0x20], xmm0
nop word [rax + rax]
mov eax, dword [rcx]
inc edx
mov dword [rcx + r8 + 0x10], eax
lea rcx, [rcx + 4]
cmp edx, 1
jb 0x18000ad70
cmp byte [r11 + r10 + 0xc], 0
jne 0x18000adf6
lea rcx, [r10 + 0x10]
add rcx, r11
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r11 + r10 + 4]
mov edx, dword [r11 + r10]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x18000adda
lea r9d, [rax + 2]
cmp edx, r9d
je 0x18000adda
cmp edx, eax
je 0x18000ade3
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x18000add3
add eax, 3
xor dword [rcx], eax
inc dword [r11 + r10]
jmp 0x18000ada0
add eax, 5
cmp edx, eax
jne 0x18000ade9
xor dword [rcx], r9d
inc dword [r11 + r10]
jmp 0x18000ada0
lea eax, [r8 + 0x33]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x18000ada0
mov eax, dword [r11 + r10 + 0x10]
mov byte [r11 + r10 + 0xc], 1
mov rcx, qword gs:[rax]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18000ae87
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18000ae87
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc3a35b27
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18000ae82
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x10dbd33
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18000ae60
cmp r8d, 0xcd9842ae
je 0x18000ae8c
test r9d, r9d
jne 0x18000ae40
mov rax, qword [rax]
jmp 0x18000ae10
mov edx, dword [rbx + 0x24]
mov rcx, rsi
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
mov r8d, 0x30
add rax, r10
lea rdx, [rsp + 0x40]
call rax
cmp dword [rsp + 0x60], 0x1000
jne 0x18000aecc
test byte [rsp + 0x64], 0xf0
je 0x18000aecc
mov eax, 1
jmp 0x18000aece
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180010210
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14143d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14143d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14143d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14143d06f
add dl, dl
jne 0x14143d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14143d0f6
xor eax, eax
add dl, dl
jne 0x14143d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14143d1ad
add dl, dl
jne 0x14143d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14143d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14143d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14143d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14143d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14143d07e
mov eax, 1
add dl, dl
jne 0x14143d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14143d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14143d0fb
sub eax, ebx
mov ebx, 1
jne 0x14143d14c
mov ecx, 1
add dl, dl
jne 0x14143d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14143d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14143d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14143d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14143d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14143d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14143d15d
cmp eax, 0x7d00
jae 0x14143d19b
cmp eax, 0x500
jb 0x14143d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14143d07e
cmp eax, 0x7f
ja 0x14143d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14143d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14143d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14143d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001650
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x140009110]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, dword [0x140009194]
xor r15d, r15d
mov word [rbp + 0x33], 0x500
lea ebx, [r15 + 2]
mov dword [rbp + 0x2f], r15d
mov dword [rbp + 0x17], r15d
cmp eax, ebx
jne 0x1400017f1
lea rcx, [rbp + 0x17]
call fcn.14000155c
test eax, eax
jne 0x1400017d8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x1f]
lea edx, [rbx + 6]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400017f1
mov rcx, qword [rbp + 0x1f]
lea rax, [rbp + 0x1b]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400017c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400017c9
mov edx, dword [rbp + 0x1b]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400017c9
mov r9d, dword [rbp + 0x1b]
mov rcx, qword [rbp + 0x1f]
lea rax, [rbp + 0x1b]
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400017c0
lea rax, [rbp + 0x27]
lea rcx, [rbp + 0x2f]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov r8d, 0x20
mov dl, bl
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400017c0
mov esi, r15d
cmp dword [rdi], r15d
jbe 0x1400017b6
lea r14, [rdi + 8]
mov ebx, 1
mov rdx, qword [rbp + 0x27]
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400017ad
add esi, ebx
add r14, 0x10
cmp esi, dword [rdi]
jb 0x140001790
jmp 0x1400017b6
mov dword [0x140009194], ebx
mov dword [rbp + 0x17], ebx
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x17]
jmp 0x1400017f1
mov ecx, dword [0x140009194]
mov eax, dword [rbp + 0x17]
mov ebx, 1
test eax, eax
cmovne ecx, ebx
mov dword [0x140009194], ecx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400080a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001f08
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140009110]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
test eax, eax
jne 0x140001f5f
and dword [rsp + 0x28], eax
xor r9d, r9d
mov edx, 0x4f5
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
call fcn.140004e14
xor eax, eax
jmp 0x140001fe2
lea r8, [rsp + 0x3c]
lea rdx, [0x140001100]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x30]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140001fc7
mov edx, 0x4f6
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
jmp 0x140001f4b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x140001fdd
mov edx, 0x4f7
jmp 0x140001fb8
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400080a0
add rsp, 0x50
pop rbx
ret
Function at 0x1400022d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test rcx, rcx
je 0x140002495
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x188]
sub rsp, 0x280
mov rax, qword [0x140009110]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x14000246e
lea rax, [rbp + 0x60]
mov r9d, 0x104
mov rdi, rbx
sub rdi, rax
mov edx, r9d
lea rcx, [rbp + 0x60]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002348
mov al, byte [rdi + rcx]
test al, al
je 0x140002348
mov byte [rcx], al
inc rcx
dec rdx
jne 0x14000232b
test rdx, rdx
jne 0x140002350
dec rcx
mov byte [rcx], 0
lea r8, [0x140001138]
lea rcx, [rbp + 0x60]
mov rdx, r9
call fcn.140001428
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000246e
mov r8d, 0x104
lea rdx, [rbp + 0x60]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x1400023a9
mov al, byte [rdi + rdx]
test al, al
je 0x1400023a9
mov byte [rdx], al
inc rdx
dec r8
jne 0x14000238c
test r8, r8
jne 0x1400023b1
dec rdx
test byte [rsp + 0x20], 0x10
mov byte [rdx], 0
je 0x14000241a
lea rdx, [0x14000113c]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140002446
lea rdx, [0x140001140]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140002446
lea r8, [rsp + 0x4c]
lea rcx, [rbp + 0x60]
mov edx, 0x104
call fcn.140001428
lea r8, [0x140001070]
lea rcx, [rbp + 0x60]
mov edx, 0x104
call fcn.1400078e4
lea rcx, [rbp + 0x60]
call fcn.1400022d0
jmp 0x140002446
lea r8, [rsp + 0x4c]
lea rcx, [rbp + 0x60]
mov edx, 0x104
call fcn.140001428
lea rcx, [rbp + 0x60]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140002382
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400080a0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000249c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140009110]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov edi, 0x104
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140002525
lea r8, [0x140001148]
lea rcx, [rsp + 0x20]
mov edx, edi
call fcn.1400078e4
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll__lopen]
mov edi, eax
cmp eax, reloc.msvcrt.dll___C_specific_handler
je 0x140002525
lea r8d, [rbx + 2]
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll__llseek]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll__lclose]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400080a0
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret

Function at 0x140002550
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
movzx eax, cx
xor ebx, ebx
test eax, eax
je 0x140002657
cmp eax, 1
je 0x1400025e7
add eax, 0xfffffffe
cmp eax, 1
ja 0x14000265e
lea rax, [rbp + 0x18]
lea rdx, str.SystemCurrentControlSetControlSession_Manager
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x10], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400025e2
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
lea rdx, str.PendingFileRenameOperations
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x10]
test eax, eax
cmovne ecx, ebx
mov dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rbp + 0x10]
jmp 0x14000265e
lea rax, [rbp + 0x18]
lea rdx, str.SystemCurrentControlSetControlSession_ManagerFileRenameOperations
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x10], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400025e2
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
jmp 0x1400025cd
call fcn.14000249c
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret