joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ac90
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
cmp dword [0x140197444], 0
je 0x14001aca8
mov eax, dword [0x140197440]
add rsp, 0x58
ret
lea rcx, str.kernel32
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14001ad1f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, rax
call rbx
test eax, eax
je 0x14001ad1f
movzx eax, word [rsp + 0x60]
mov ecx, 0xaa64
cmp cx, ax
je 0x14001ad04
mov ecx, 0x1c0
cmp cx, ax
jne 0x14001ad47
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov dword [0x140197440], eax
mov dword [0x140197444], eax
add rsp, 0x58
ret
cmp dword [0x140197444], 0
jne 0x14001ad63
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx r11d, word [rsp + 0x20]
cmp r11w, 5
je 0x14001ad04
cmp r11w, 0xc
je 0x14001ad04
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov dword [0x140197444], 1
mov dword [0x140197440], eax
add rsp, 0x58
ret
mov eax, dword [0x140197440]
mov rbx, qword [rsp + 0x50]
mov dword [0x140197444], 1
add rsp, 0x58
ret

Function at 0x14001aea0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
lea rdx, str.SYSTEMCurrentControlSetServicesMountMgr
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001af8f
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.NoAutoMount
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001af32
cmp dword [rsp + 0x48], eax
je 0x14001af32
cmp dword [0x140196ef0], eax
jne 0x14001af84
lea rcx, str.SYS_AUTOMOUNT_DISABLED
jmp 0x14001af66
cmp dword [0x140196f2c], 0xb
jne 0x14001af56
cmp dword [0x140196f38], 1
jge 0x14001af56
cmp dword [0x140196ef0], 0
jne 0x14001af84
lea rcx, str.SYS_ASSIGN_DRIVE_LETTER
jmp 0x14001af66
cmp dword [0x140196ef0], 0
jne 0x14001af84
lea rcx, str.DEVICE_NOT_READY_ERROR
call fcn.14003a7b0
mov r8, qword [0x140196ee8]
mov r9d, 0x30
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x14001afa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r8, rcx
movzx edx, dx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rdi, rdi
je 0x14001afe3
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rdi], eax
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LockResource]
Function at 0x14001b280
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x278
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rdx, [rsp + 0x50]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x14001b2c8
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x278
ret
xor eax, eax
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14001b2ae
mov eax, dword [rsp + 0x40]
shr eax, 0x13
and eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x278
ret
Function at 0x14001c530
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [0x140197318], 0
jne 0x14001c703
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x250], rbx
mov word [rsp + 0x20], di
call fcn.1400a4ea0
mov ebx, 0x104
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
lea rax, [rsp + 0x20]
je 0x14001c60a
mov ecx, ebx
cmp word [rax], di
je 0x14001c5aa
add rax, 2
dec rcx
jne 0x14001c597
jmp 0x14001c64f
test rcx, rcx
je 0x14001c64f
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [rsp + rdx*2 + 0x20]
je 0x14001c601
lea r8, str.Wintrust.dll
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r8, rax
test rcx, rcx
je 0x14001c5fc
movzx edx, word [r8 + rax]
test dx, dx
je 0x14001c5fc
mov word [rax], dx
add rax, 2
dec rcx
dec rbx
jne 0x14001c5d5
sub rax, 2
mov word [rax], di
jmp 0x14001c64f
test rbx, rbx
jne 0x14001c605
sub rax, 2
mov word [rax], di
jmp 0x14001c64f
lea rdx, str.C:WindowsSystem32Wintrust.dll
lea rcx, [rsp + 0x20]
sub rdx, rax
nop dword [rax]
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x14001c643
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14001c643
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x14001c620
jmp 0x14001c648
test rbx, rbx
jne 0x14001c64c
sub rcx, 2
mov word [rcx], di
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, qword [rsp + 0x250]
mov qword [0x140197318], rax
test rax, rax
je 0x14001c735
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140197318]
lea rdx, str.WTHelperProvDataFromStateData
mov qword [0x1401973a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140197318]
lea rdx, str.WTHelperGetProvSignerFromChain
mov qword [0x1401973a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140197318]
lea rdx, str.WTHelperGetProvCertFromChain
mov qword [0x1401973b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1401973a0], rdi
mov qword [0x1401973b8], rax
je 0x14001c721
cmp qword [0x1401973a8], rdi
je 0x14001c721
cmp qword [0x1401973b0], rdi
je 0x14001c721
test rax, rax
je 0x14001c721
cmp qword [0x140197318], rdi
je 0x14001c735
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x240
pop rdi
ret
mov rcx, qword [0x140197318]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140197318], rdi
xor eax, eax
jmp 0x14001c708
Function at 0x14001c750
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, str.ntdll.dll
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001c79e
lea rcx, [rsp + 0x20]
call rax
test eax, eax
je 0x14001c7c2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14001c7c2
lea rcx, str.NO_OS_VER
call fcn.14003a7b0
mov rcx, rax
call fcn.140018310
int3
movzx eax, word [rsp + 0x134]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
mov dword [0x140196f38], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x140196f30], edx
mov dword [0x140196f3c], eax
mov eax, dword [rsp + 0x30]
mov dword [0x140196f34], ecx
cmp eax, 2
jne 0x14001c96a
cmp edx, 5
jne 0x14001c8ae
test ecx, ecx
jne 0x14001c82a
mov dword [0x140196f2c], 7
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
cmp ecx, 1
jne 0x14001c851
mov dword [0x140196f2c], 8
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
cmp ecx, 2
jne 0x14001ca12
movzx eax, byte [rsp + 0x13a]
cmp al, 3
je 0x14001c88c
cmp al, cl
je 0x14001c88c
mov dword [0x140196f2c], 9
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
mov dword [0x140196f2c], 0xa
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
cmp edx, 6
jne 0x14001c91d
test ecx, ecx
jne 0x14001c8cc
xor eax, eax
cmp byte [rsp + 0x13a], 1
setne al
add eax, 0xb
jmp 0x14001ca14
cmp ecx, 1
jne 0x14001c8e5
xor eax, eax
cmp byte [rsp + 0x13a], cl
setne al
add eax, 0xd
jmp 0x14001ca14
cmp ecx, 2
jne 0x14001c8ff
xor eax, eax
cmp byte [rsp + 0x13a], 1
setne al
add eax, 0xf
jmp 0x14001ca14
cmp ecx, 3
jne 0x14001ca12
xor eax, eax
cmp byte [rsp + 0x13a], 1
setne al
add eax, 0x11
jmp 0x14001ca14
cmp edx, 0xa
jne 0x14001c93f
test ecx, ecx
jne 0x14001ca12
xor eax, eax
cmp byte [rsp + 0x13a], 1
setne al
add eax, 0x13
jmp 0x14001ca14
cmp edx, 4
jne 0x14001ca12
mov dword [0x140196f2c], 6
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
cmp eax, 1
jne 0x14001c9ec
cmp edx, 4
jne 0x14001ca12
test ecx, ecx
jne 0x14001c99e
mov dword [0x140196f2c], 2
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
cmp ecx, 0xa
jne 0x14001c9c5
mov dword [0x140196f2c], 3
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
cmp ecx, 0x5a
jne 0x14001ca12
mov dword [0x140196f2c], 4
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
test eax, eax
jne 0x14001ca12
mov dword [0x140196f2c], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
xor eax, eax
mov dword [0x140196f2c], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x158
ret
Function at 0x14001cd20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor eax, eax
mov rsi, rcx
movzx ecx, dx
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], eax
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx rdi, ax
mov rdx, rdi
shr rdx, 8
test dl, 2
je 0x14001cd5b
test dl, 4
jne 0x14001cd5b
mov bl, 1
jmp 0x14001cd5d
xor bl, bl
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd5
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
mov edx, 0xb0
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x70]
cmp dword [rsp + 0x78], edx
jne 0x14001ce63
cmp dil, 0x2e
je 0x14001ce63
cmp dil, 8
je 0x14001ce63
test bl, bl
jne 0x14001ce63
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, ebp
jne 0x14001ce63
lea rcx, str.PASSWORD_MAXLENGTH_REACHED
call fcn.14003a7b0
or rcx, 0xffffffffffffffff
mov rdi, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
add ecx, 0xf
mov edi, ecx
add rcx, rcx
call fcn.1400a4fcc
lea rcx, str.PASSWORD_MAXLENGTH_REACHED
mov rbx, rax
call fcn.14003a7b0
mov r9d, ebp
mov edx, edi
mov rcx, rbx
mov r8, rax
call fcn.140013cf0
mov rcx, qword [0x140196ee8]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov edx, 0x1503
mov rcx, rsi
mov dword [rsp + 0x20], 0x20
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 6
call qword [sym.imp.USER32.dll_SendMessageW]
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
mov rcx, rbx
call fcn.1400a4f8c
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1504
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001d2d0
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401971b0]
test rax, rax
jne 0x14001d33e
lea r8, str.GlobalVeraCrypt_Driver_Setup
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1401971b0], rax
mov rax, qword [0x1401971b0]
test rax, rax
je 0x14001d337
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14001d33e
mov rcx, qword [0x1401971b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x1401971b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401971b0], 0
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x14001da70
Capabilities:
Query service status

Disassembly:
push r12
mov eax, 0x4bc0
call fcn.1400a5130
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x4bd0], rbx
mov qword [rsp + 0x4bd8], rsi
mov qword [rsp + 0x4be0], rdi
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x4bb0], rax
xor ebx, ebx
mov edi, ebx
cmp qword [0x140148300], 0xffffffffffffffff
je 0x14001dc93
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x20], 1
mov r9b, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.140011550
nop
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.14000aa10
mov esi, dword [rax]
lea rcx, [rsp + 0xe0]
call fcn.1400112f0
test esi, esi
je 0x14001db0d
xor eax, eax
jmp 0x14001dc9c
jmp 0x14001db13
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x222028
mov rcx, qword [0x140148300]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14001dba1
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4410
lea rax, [rsp + 0x7a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x72004
mov rcx, qword [0x140148300]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14001dc93
mov eax, dword [rsp + 0x7a0]
mov dword [rsp + 0x40], eax
jmp 0x14001dba5
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14001dc9a
call fcn.14001a980
cmp eax, 1
jg 0x14001dc9a
mov rcx, qword [0x140148300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140148300], 0xffffffffffffffff
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
je 0x14001dc9a
mov r8d, 0xf01ff
lea rdx, [0x1400cd980]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x14001dc7b
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
jne 0x14001dc72
cmp dword [rsp + 0x5c], eax
je 0x14001dc6d
lea r8, [rsp + 0x58]
mov edx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
nop word [rax + rax]
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
jne 0x14001dc72
cmp dword [rsp + 0x5c], eax
je 0x14001dc6d
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x14001dc40
jmp 0x14001dc72
mov edi, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x14001dc9a
mov qword [0x140148300], 0xffffffffffffffff
mov eax, 1
jmp 0x14001dc9c
xor eax, eax
mov rcx, qword [rsp + 0x4bb0]
xor rcx, rsp
call fcn.1400a4e70
lea r11, [rsp + 0x4bc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x14001e710
Capabilities:
Get disk information

Disassembly:
push rsi
sub rsp, 0x440
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x430], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp dword [0x140196ef4], 0
mov esi, eax
jne 0x14001e807
lea rcx, [0x140150808]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call fcn.1400a745c
sub rax, qword [0x1401974c8]
cmp rax, 0x3c
jle 0x14001e7fa
mov qword [rsp + 0x450], rbx
mov eax, 0x41
xor ebx, ebx
mov qword [rsp + 0x458], rdi
mov dword [rsp + 0x26], 0x3a
mov dword [0x1401974c0], ebx
mov word [rsp + 0x24], ax
nop
movzx ecx, bl
mov edi, 1
shl edi, cl
test esi, edi
jne 0x14001e7d3
lea eax, [rbx + 0x41]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], 0x200
mov word [rsp + 0x24], ax
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
je 0x14001e7cd
cmp eax, 0x4b1
jne 0x14001e7d3
or dword [0x1401974c0], edi
inc bx
cmp bx, 0x19
jbe 0x14001e790
xor ecx, ecx
call fcn.1400a745c
mov rdi, qword [rsp + 0x458]
mov rbx, qword [rsp + 0x450]
mov qword [0x1401974c8], rax
or esi, dword [0x1401974c0]
call fcn.14001a2c0
mov eax, esi
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x440
pop rsi
ret

Function at 0x14001ed90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x140196f30]
mov ebx, 1
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], ebx
test eax, eax
jg 0x14001edbf
mov byte [0], 0
mov eax, dword [0x140196f30]
shl eax, 8
or eax, dword [0x140196f34]
shl eax, 8
or eax, dword [0x140196f38]
cmp eax, 0x60000
jge 0x14001ede0
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ee4f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, str.EnableLUA
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x40], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [rsp + 0x40], eax
setne al
add rsp, 0x30
pop rbx
ret
Function at 0x140020270
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1260
call fcn.1400a5130
sub rsp, rax
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x1250], rax
add dx, 0x41
xor esi, esi
mov edi, r8d
mov rbx, rcx
mov dword [rsp + 0x32], 0x3a
mov word [rsp + 0x30], dx
test r8d, r8d
je 0x1400202e9
cmp dword [0x140196ef0], esi
jne 0x140020466
lea rcx, str.FILESYS_REPAIR_CONFIRM_BACKUP
call fcn.14003a7b0
mov r8, qword [0x140196ee8]
lea r9d, [rsi + 0x34]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x140020466
lea rax, str.REPAIRING_FS
lea rcx, str.CHECKING_FS
test edi, edi
cmovne rcx, rax
call fcn.14003a7b0
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x250]
mov r8, rax
mov edx, 0x800
call section..text
lea rax, str._C_echo__s__chkdsk__s__F__X__pause
lea r8, str._C_echo__s__chkdsk__s__pause
test edi, edi
lea r9, [rsp + 0x250]
lea rcx, [rsp + 0xa50]
cmovne r8, rax
lea rax, [rsp + 0x30]
mov edx, 0x800
mov qword [rsp + 0x20], rax
call section..text
mov ebx, 0x104
lea rcx, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
lea rax, [rsp + 0x40]
je 0x1400203e5
mov ecx, ebx
cmp word [rax], si
je 0x140020384
add rax, 2
dec rcx
jne 0x140020371
jmp 0x140020423
test rcx, rcx
je 0x140020423
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [rsp + rdx*2 + 0x40]
je 0x1400203dc
lea r8, str.cmd.exe
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r8, rax
nop
test rcx, rcx
je 0x1400203d7
movzx edx, word [r8 + rax]
test dx, dx
je 0x1400203d7
mov word [rax], dx
add rax, 2
dec rcx
dec rbx
jne 0x1400203b0
sub rax, 2
mov word [rax], si
jmp 0x140020423
test rbx, rbx
jne 0x1400203e0
sub rax, 2
mov word [rax], si
jmp 0x140020423
lea rdx, str.C:WindowsSystem32cmd.exe
lea rcx, [rsp + 0x40]
sub rdx, rax
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140020417
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140020417
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x1400203f4
jmp 0x14002041c
test rbx, rbx
jne 0x140020420
sub rcx, 2
mov word [rcx], si
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x14002043d
call fcn.14001ed90
lea rdx, str.runas
test eax, eax
jne 0x140020444
lea rdx, str.open
lea r9, [rsp + 0xa50]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x1260
pop rdi
pop rsi
pop rbx
ret
Function at 0x140020500
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x168
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r13d, r9d
mov rbx, r8
mov r12d, edx
mov rsi, rcx
xor r14d, r14d
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x40]
mov r8d, 0x81
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [rsp + 0x1c0], r14d
jne 0x14002055f
cmp dword [0x140196f08], r14d
je 0x140020583
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x40
jle 0x140020583
lea rdi, [rsp + 0xc0]
movzx eax, r14w
mov ecx, 0x41
rep stosw word [rdi], ax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, 0x102
lea rdi, [rsp + 0x40]
mov r11d, eax
xor eax, eax
mov ecx, edx
lea r8, [rsp + 0x40]
rep stosb byte [rdi], al
mov byte [r8], al
inc r8
dec rdx
jne 0x1400205c5
test r11d, r11d
jle 0x1400205dd
lea eax, [rdx + 1]
jmp 0x1400206c5
mov byte [rbx], al
cmp dword [rsp + 0x1c8], eax
je 0x1400206c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002067f
lea rcx, str.PASSWORD_UTF8_TOO_LONG
mov qword [rsp + 0x160], rbp
call fcn.14003a7b0
or rcx, 0xffffffffffffffff
mov rdi, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
add ecx, 0xf
mov ebx, ecx
add rcx, rcx
call fcn.1400a4fcc
lea rcx, str.PASSWORD_UTF8_TOO_LONG
mov rbp, rax
call fcn.14003a7b0
lea r9d, [r13 - 1]
mov edx, ebx
mov rcx, rbp
mov r8, rax
call fcn.140013cf0
cmp dword [0x140196ef0], r14d
jne 0x14002066d
mov r8, qword [0x140196ee8]
mov r9d, 0x10
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rbp
call fcn.1400a4f8c
mov rbp, qword [rsp + 0x160]
jmp 0x1400206ad
cmp dword [0x140196ef0], r14d
jne 0x1400206ad
lea rcx, str.PASSWORD_UTF8_INVALID
call fcn.14003a7b0
mov r8, qword [0x140196ee8]
mov r9d, 0x10
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
mov eax, r14d
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x168
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret