joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400097e0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov eax, dword [rsp + 0x70]
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r9d
mov r9, r8
mov r8d, edx
mov edx, 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140009851
mov rdx, qword [0x14003f730]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140009843
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r9, rax
mov qword [rsp + 0x20], 0
mov eax, 1
mov r8, rdi
movzx ecx, ax
mov edx, 0xc0000419
call fcn.140002610
mov rbx, qword [rsp + 0x50]
mov rax, 0xffffffffffffffff
add rsp, 0x40
pop rdi
ret

Function at 0x1400098a0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push r12
push r14
sub rsp, 0x48
cmp byte [rcx + 0x48], 0
mov rbp, r9
mov r14d, r8d
mov r12, rdx
mov rbx, rcx
je 0x140009a24
cmp qword [rcx + 0x50], 0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
mov qword [rax - 0x28], r15
mov r15, qword [rsp + 0x90]
mov dword [rax + 8], 0
jne 0x14000990b
mov edx, dword [rsp + 0x98]
lea r9, [rax - 0x38]
lea r8, [rax + 8]
call fcn.1400096a0
mov ecx, dword [rsp + 0x70]
add qword [rbx + 0x50], rcx
add dword [rbp], ecx
mov eax, dword [rsp + 0x30]
or dword [r15], eax
mov ecx, dword [rsp + 0x70]
xor r13d, r13d
xor edi, edi
test r14d, r14d
je 0x140009a02
mov qword [rsp + 0x78], rsi
mov rsi, r12
mov dword [rsp + 0x3c], ecx
nop dword [rax]
cmp byte [rsi], 0xa
jne 0x1400099b4
mov r8d, edi
lea rax, [rsp + 0x38]
sub r8d, r13d
mov qword [rsp + 0x20], rax
inc r8d
lea r9, [rsp + 0x34]
mov rdx, r12
mov rcx, rbx
call fcn.1400094e0
mov ecx, r13d
inc r12
mov qword [rbx + 0x50], 0
lea r13d, [rdi + 1]
mov edx, edi
sub rdx, rcx
mov dword [rsp + 0x3c], eax
mov ecx, dword [rsp + 0x34]
add r12, rdx
add dword [rbp], ecx
mov ecx, dword [rsp + 0x38]
or dword [r15], ecx
cmp r13d, r14d
jae 0x1400099b4
mov edx, dword [rsp + 0x98]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x70]
mov rcx, rbx
call fcn.1400096a0
mov ecx, dword [rsp + 0x70]
add qword [rbx + 0x50], rcx
add dword [rbp], ecx
mov eax, dword [rsp + 0x30]
or dword [r15], eax
inc edi
inc rsi
cmp edi, r14d
jb 0x140009930
mov rsi, qword [rsp + 0x78]
cmp r13d, r14d
jae 0x1400099fe
lea rax, [rsp + 0x38]
sub r14d, r13d
mov r8d, r14d
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov rdx, r12
mov rcx, rbx
call fcn.1400094e0
mov ecx, eax
mov eax, dword [rsp + 0x34]
add dword [rbp], eax
mov eax, dword [rsp + 0x38]
or dword [r15], eax
jmp 0x140009a02
mov ecx, dword [rsp + 0x3c]
mov r15, qword [rsp + 0x40]
mov eax, ecx
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
add rsp, 0x48
pop r14
pop r12
pop rbp
pop rbx
ret
add rsp, 0x48
pop r14
pop r12
pop rbp
pop rbx
jmp fcn.1400094e0
Function at 0x140009ab0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov byte [0x14006f740], 0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
xor eax, eax
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x48], eax
mov r9d, 0x220
mov dword [rsp + 0x40], eax
mov dl, 2
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea r8d, [rax + 0x20]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov word [rsp + 0x6c], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140009b3a
mov rdx, qword [rsp + 0x60]
lea r8, [0x14006f740]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x88
ret

Function at 0x140009b50
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
mov ecx, 2
mov ebx, r8d
mov rsi, rdx
call fcn.14001c1d0
mov rcx, rax
mov edx, ebx
call fcn.140002950
xorps xmm0, xmm0
lea rax, str.runas
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], 0x70
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
call fcn.140009dd0
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0xfffe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x140009c13
lea ecx, [rax + 2]
call fcn.14001c1d0
mov rcx, rax
lea r9, str.elevate__
lea r8, str.GetCommandLine__
mov edx, 0xc00001fa
call fcn.140002950
lea eax, [rdi + 0x6f]
jmp 0x140009cbf
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, 0xffffffffffffffff
lea r9, [0x14002ecd8]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 0x7fff
mov rcx, rdi
call fcn.140001d80
mov rax, qword [rsi]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140009c40
cmp word [rdi], 0x22
mov ecx, 1
mov eax, 3
cmovne eax, ecx
add rbx, rax
movzx ecx, word [rdi + rbx*2]
call fcn.14001f89c
test eax, eax
je 0x140009c81
nop dword [rax + rax]
movzx ecx, word [rdi + rbx*2 + 2]
inc rbx
call fcn.14001f89c
test eax, eax
jne 0x140009c70
lea rax, [rdi + rbx*2]
mov dword [rsp + 0x60], 5
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rax
xor ebx, ebx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
mov ecx, 0x64
cmove ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000a920
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rbp - 8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rbp - 0x40]
mov rcx, rax
lea edx, [r8 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x14000a987
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x14000a987
mov ecx, 2
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rbp - 0x40]
mov rcx, rax
lea edx, [r8 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp qword [rbp - 0x40], 0
je 0x14000aa37
lea r8, [rbp - 0x30]
mov dword [rbp - 0x38], 0x10
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 0x40]
test eax, eax
je 0x14000aa31
mov rax, qword [rbp - 0x30]
lea r8, [rbp - 0x18]
mov r9d, dword [rbp - 0x38]
xor edx, edx
mov qword [rbp - 0x14], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x40]
test eax, eax
je 0x14000aa31
mov rax, qword [rbp - 0x30]
lea r8, [rbp - 0x28]
mov r9d, dword [rbp - 0x38]
xor edx, edx
or dword [rbp - 0x1c], 2
mov qword [rsp + 0x28], 0
mov qword [rbp - 0x24], rax
mov dword [rbp - 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000aa50
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x70
pop rbp
ret
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x70
pop rbp
ret
Function at 0x14000ad40
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov rdx, rcx
xor ecx, ecx
jmp 0x14000ad50
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
test rdx, rdx
je 0x14000ae4c
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000ad87
cmp dword [rsp + 0x48], 0x103
jne 0x14000ae4c
test byte [rbx + 0x1c], 1
je 0x14000ad9d
mov rcx, rbx
call fcn.14000ab60
test eax, eax
je 0x14000ae4c
test byte [rbx + 0x1c], 2
lea rdi, str.kill_process
je 0x14000adeb
mov rdx, rbx
lea rcx, [0x14000b030]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp dword [rbx + 0x50], 0
je 0x14000adeb
mov eax, dword [rbx + 0x24]
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call fcn.14000f0c0
test eax, eax
je 0x14000ae4c
mov dword [rbx + 0x50], 0
test byte [rbx + 0x1c], 4
je 0x14000ae21
mov rcx, rbx
call fcn.14000ae80
test eax, eax
je 0x14000ae21
mov eax, dword [rbx + 0x28]
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call fcn.14000f0c0
test eax, eax
je 0x14000ae4c
test byte [rbx + 0x1c], 8
je 0x14000ae3f
mov edx, dword [rbx + 0x18]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14000ad50
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov rdx, rcx
xor ecx, ecx
jmp 0x14000ad50
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
test rdx, rdx
je 0x14000ae4c
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000ad87
cmp dword [rsp + 0x48], 0x103
jne 0x14000ae4c
test byte [rbx + 0x1c], 1
je 0x14000ad9d
mov rcx, rbx
call fcn.14000ab60
test eax, eax
je 0x14000ae4c
test byte [rbx + 0x1c], 2
lea rdi, str.kill_process
je 0x14000adeb
mov rdx, rbx
lea rcx, [0x14000b030]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp dword [rbx + 0x50], 0
je 0x14000adeb
mov eax, dword [rbx + 0x24]
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call fcn.14000f0c0
test eax, eax
je 0x14000ae4c
mov dword [rbx + 0x50], 0
test byte [rbx + 0x1c], 4
je 0x14000ae21
mov rcx, rbx
call fcn.14000ae80
test eax, eax
je 0x14000ae21
mov eax, dword [rbx + 0x28]
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call fcn.14000f0c0
test eax, eax
je 0x14000ae4c
test byte [rbx + 0x1c], 8
je 0x14000ae3f
mov edx, dword [rbx + 0x18]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14000ae60
Capabilities:
Enumerate processes

Disassembly:
mov r9d, edx
mov r8, rcx
lea rdx, [0x14000ad50]
xor ecx, ecx
jmp fcn.14000b2a0
Function at 0x14000ae80
Capabilities:
Enumerate threads

Disassembly:
mov rdx, rcx
xor ecx, ecx
jmp 0x14000ae90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov rbx, rdx
xor edx, edx
mov esi, ebp
lea ecx, [rbp + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000aefe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r8, qword [rbx]
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], rbp
movzx ecx, ax
mov edx, 0xc0000408
call fcn.140002610
xor eax, eax
jmp 0x14000b001
xorps xmm0, xmm0
mov qword [rsp + 0x44], rbp
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x1c
mov rcx, rdi
movdqu xmmword [rsp + 0x34], xmm0
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x14000af5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r8, qword [rbx]
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], rbp
movzx ecx, ax
mov edx, 0xc0000409
call fcn.140002610
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000b001
mov eax, dword [rbx + 0x14]
cmp dword [rsp + 0x3c], eax
jne 0x14000af7f
mov r8d, dword [rbx + 0x18]
xor r9d, r9d
mov ecx, dword [rsp + 0x38]
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov esi, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x14000afc1
mov ecx, dword [rbx + 0x14]
cmp dword [rsp + 0x3c], ecx
jne 0x14000afb0
mov r8d, dword [rbx + 0x18]
xor r9d, r9d
mov ecx, dword [rsp + 0x38]
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
or esi, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14000af90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x14000aff6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r8, qword [rbx]
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], rbp
movzx ecx, ax
mov edx, 0xc0000409
call fcn.140002610
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400180d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000ae90
Capabilities:
Enumerate threads

Disassembly:
mov rdx, rcx
xor ecx, ecx
jmp 0x14000ae90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov rbx, rdx
xor edx, edx
mov esi, ebp
lea ecx, [rbp + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000aefe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r8, qword [rbx]
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], rbp
movzx ecx, ax
mov edx, 0xc0000408
call fcn.140002610
xor eax, eax
jmp 0x14000b001
xorps xmm0, xmm0
mov qword [rsp + 0x44], rbp
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x1c
mov rcx, rdi
movdqu xmmword [rsp + 0x34], xmm0
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x14000af5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r8, qword [rbx]
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], rbp
movzx ecx, ax
mov edx, 0xc0000409
call fcn.140002610
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000b001
mov eax, dword [rbx + 0x14]
cmp dword [rsp + 0x3c], eax
jne 0x14000af7f
mov r8d, dword [rbx + 0x18]
xor r9d, r9d
mov ecx, dword [rsp + 0x38]
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov esi, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x14000afc1
mov ecx, dword [rbx + 0x14]
cmp dword [rsp + 0x3c], ecx
jne 0x14000afb0
mov r8d, dword [rbx + 0x18]
xor r9d, r9d
mov ecx, dword [rsp + 0x38]
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
or esi, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14000af90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x14000aff6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r8, qword [rbx]
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], rbp
movzx ecx, ax
mov edx, 0xc0000409
call fcn.140002610
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400180d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000ba50
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx esi, r8b
mov dword [rsp + 0x20], 0xff
mov rbx, rdx
lea r8, str.AppExit
mov dl, 1
lea r9, [rsp + 0x60]
call fcn.14000e060
xor edi, edi
test eax, eax
jns 0x14000bac6
lea ebx, [rdi + 1]
mov qword [rsp + 0x20], rdi
movzx ecx, bx
lea r9, str.create_exit_action__
lea r8, str.NSSM_REG_EXIT
mov edx, 0xc00003eb
call fcn.140002610
mov eax, ebx
jmp 0x14000bbcd
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000bb3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ebx, 1
mov qword [rsp + 0x20], rdi
movzx ecx, bx
lea r8, [rsp + 0x60]
mov r9, rax
mov edx, 0xc00003f9
call fcn.140002610
lea eax, [rbx + 1]
jmp 0x14000bbcd
cmp dword [rsp + 0x58], 2
jne 0x14000bb47
test sil, sil
je 0x14000bbc0
mov rax, 0xffffffffffffffff
nop
cmp word [rbx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14000bb50
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ebx, 1
mov r9d, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000bbc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r9, rax
movzx ecx, bx
lea r8, str.AppExit
mov qword [rsp + 0x20], rdi
mov edx, 0xc00003fb
call fcn.140002610
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rbx + 2]
jmp 0x14000bbcd
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400180d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000bc00
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, str.NSSM
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov qword [rsp + 0x20], rax
lea r9, str.SYSTEMCurrentControlSetServicesEventLogApplication_s
mov edx, 0xff
lea rcx, [rsp + 0x60]
call fcn.140001d80
xor edi, edi
test eax, eax
jns 0x14000bc7b
lea ebx, [rdi + 1]
mov qword [rsp + 0x20], rdi
movzx ecx, bx
lea r9, str.create_messages__
lea r8, str.eventlog_registry
mov edx, 0xc00003eb
call fcn.140002610
mov eax, ebx
jmp 0x14000bd5d
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000bce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ebx, 1
mov qword [rsp + 0x20], rdi
movzx ecx, bx
lea r8, [rsp + 0x60]
mov r9, rax
mov edx, 0xc00003f9
call fcn.140002610
lea eax, [rbx + 1]
jmp 0x14000bd5d
call fcn.140009de0
mov rcx, rax
cmp word [rax + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x14000bcf0
lea eax, [rbx*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str.EventMessageFile
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
lea rdx, str.TypesSupported
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400180d0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x14000c800
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov rbx, rdx
mov dword [r11 + 0x20], r9d
xor edx, edx
lea rax, [r11 - 0x18]
mov qword [r11 - 0x20], rdx
lea r9, [r11 + 0x20]
mov qword [r11 - 0x28], rdx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rdx
mov edx, dword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14000c837
inc dword [rbx]
add rsp, 0x50
pop rbx
ret

Function at 0x14000c980
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, qword [rsp + 0x80]
lea rax, [r11 + 0x28]
mov rsi, r8
mov qword [r11 - 0x30], rax
mov rbp, rdx
mov dword [rsp + 0x30], 7
mov rdi, r9
mov rbx, rcx
xor r15d, r15d
lea r9, [r11 - 0x28]
xor r8d, r8d
mov dword [r14], r15d
mov rdx, rsi
mov qword [r11 - 0x38], r15
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000ca14
mov qword [rdi], r15
cmp eax, 2
je 0x14000cb35
mov ecx, eax
call fcn.140002510
mov ebx, 1
mov qword [rsp + 0x20], r15
movzx ecx, bx
mov r9, rax
mov r8, rsi
mov edx, 0xc00003fa
call fcn.140002610
mov eax, ebx
jmp 0x14000cb37
cmp dword [rsp + 0x30], 7
je 0x14000ca42
mov ebp, 2
mov qword [rsp + 0x20], r15
movzx ecx, bp
mov r9, rbx
mov r8, rsi
mov edx, 0x8000040f
call fcn.140002610
mov eax, ebp
mov qword [rdi], r15
jmp 0x14000cb37
mov eax, dword [rsp + 0x80]
cmp eax, 8
jae 0x14000ca5b
mov qword [rdi], r15
mov eax, 3
jmp 0x14000cb37
mov rbx, qword [rdi]
test rbx, rbx
je 0x14000ca7e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x80]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
test rax, rax
jne 0x14000cac0
lea ebx, [rax + 1]
mov qword [rsp + 0x20], r15
movzx ecx, bx
lea r9, str.get_environment__
mov r8, rsi
mov edx, 0xc00003eb
call fcn.140002610
lea eax, [rbx + 3]
jmp 0x14000cb37
lea rcx, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x30]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000cb2a
mov ecx, eax
call fcn.140002510
mov ebx, 1
mov qword [rsp + 0x20], r15
movzx ecx, bx
mov r9, rax
mov r8, rsi
mov edx, 0xc00003fa
call fcn.140002610
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rdi]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [rbx + 4]
mov qword [rdi], r15
jmp 0x14000cb37
mov rcx, qword [rdi]
call fcn.140002010
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret