joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100002878
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov r15d, 0xa2
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0
mov ebp, 0x8000
test bp, ax
lea edi, [rbx + 1]
lea ecx, [r15 + 1]
cmovne ebx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
lea esi, [rdi + 1]
test bp, ax
je 0x1000028cd
or ebx, esi
mov r12d, 0xa4
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x1000028e4
or ebx, 4
mov r13d, 0xa5
mov ecx, r13d
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x1000028fb
or ebx, 8
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x10000290e
or ebx, 0x10
mov r14d, 0xa1
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x100002925
or ebx, 0x20
lea rcx, [rsp + 0x28]
xor ebp, ebp
xor edx, edx
mov r8d, 0x278
mov dword [rsp + 0x20], ebp
call sub.msvcrt.dll_memset
mov r11d, ebp
test dil, bl
je 0x100002956
mov dword [rsp + 0x20], edi
mov word [rsp + 0x28], r15w
mov dword [rsp + 0x2c], esi
mov r11d, edi
mov edx, 3
test sil, bl
je 0x10000297c
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov eax, 0xa3
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], ax
mov dword [rsp + rcx*8 + 0x2c], edx
test bl, 4
je 0x100002999
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], r12w
mov dword [rsp + rcx*8 + 0x2c], esi
test bl, 8
je 0x1000029b6
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], r13w
mov dword [rsp + rcx*8 + 0x2c], edx
test bl, 0x10
je 0x1000029d7
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov eax, 0xa0
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], ax
mov dword [rsp + rcx*8 + 0x2c], esi
test bl, 0x20
je 0x1000029f4
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
mov dword [rsp + rcx*8 + 0x20], edi
mov word [rsp + rcx*8 + 0x28], r14w
mov dword [rsp + rcx*8 + 0x2c], esi
movsxd rax, r11d
mov r8d, 0x5b
add r11d, edi
lea rcx, [rax + rax*4]
movsxd rax, r11d
lea edx, [r8 - 6]
mov word [rsp + rcx*8 + 0x28], r8w
mov dword [rsp + rcx*8 + 0x20], edi
mov dword [rsp + rcx*8 + 0x2c], ebp
lea rcx, [rax + rax*4]
add r11d, edi
mov word [rsp + rcx*8 + 0x28], dx
mov dword [rsp + rcx*8 + 0x20], edi
mov dword [rsp + rcx*8 + 0x2c], ebp
movsxd rax, r11d
add r11d, edi
lea rcx, [rax + rax*4]
movsxd rax, r11d
mov word [rsp + rcx*8 + 0x28], dx
mov dword [rsp + rcx*8 + 0x20], edi
mov dword [rsp + rcx*8 + 0x2c], esi
lea rcx, [rax + rax*4]
mov word [rsp + rcx*8 + 0x28], r8w
mov dword [rsp + rcx*8 + 0x20], edi
mov dword [rsp + rcx*8 + 0x2c], esi
lea r8d, [rdx - 0x2d]
lea ecx, [r11 + 1]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendInput]
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100002d8c
Capabilities:
Enumerate process modules

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov eax, 0x2260
call fcn.10000b2f0
sub rsp, rax
mov rax, qword [0x10000f130]
xor rax, rsp
mov qword [rsp + 0x2250], rax
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov edx, 0x2000
xor ebx, ebx
call sub.KERNEL32.dll_K32EnumProcesses
cmp eax, ebx
jne 0x100002de1
xor eax, eax
jmp 0x100002ed6
mov eax, dword [rsp + 0x20]
mov ecx, 0x800
shr eax, 2
cmp eax, ecx
cmova eax, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x24]
mov ecx, eax
mov r12d, eax
mov dword [rsp + 0x24], ebx
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp eax, ebx
je 0x100002dda
mov esi, ebx
cmp dword [rsp + 0x20], ebx
jbe 0x100002ed4
lea rdi, [rsp + 0x40]
mov ecx, dword [rdi]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp eax, ebx
je 0x100002ebe
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jne 0x100002ebe
cmp r12d, dword [rdi]
je 0x100002ebe
mov r8d, dword [rdi]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
cmp rax, rbx
je 0x100002ebe
lea r9, [rsp + 0x2c]
lea rdx, [rsp + 0x30]
mov r8d, 8
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
cmp eax, ebx
je 0x100002eb5
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x2040]
mov r9d, 0x104
mov rcx, rbp
call sub.KERNEL32.dll_K32GetModuleBaseNameW
cmp eax, ebx
je 0x100002eb5
lea rdx, [0x100001998]
lea rcx, [rsp + 0x2040]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
je 0x100002ecf
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add rdi, 4
cmp esi, dword [rsp + 0x20]
jae 0x100002ed4
jmp 0x100002e25
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x2250]
xor rcx, rsp
call fcn.10000a940
lea r11, [rsp + 0x2260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x100002f0c
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x10000f130]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor esi, esi
lea rax, [r11 - 0x20]
lea rcx, [r11 - 0x18]
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
lea edi, [rsi + 1]
lea r8d, [rsi + 4]
xor r9d, r9d
mov dl, dil
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x60], esi
mov byte [rsp + 0x70], sil
mov dword [rsp + 0x20], esi
mov byte [rsp + 0x71], sil
mov byte [rsp + 0x72], sil
mov byte [rsp + 0x73], sil
mov byte [rsp + 0x74], sil
mov byte [rsp + 0x75], 5
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
neg eax
sbb rdx, rdx
and rdx, qword [rsp + 0x68]
mov qword [rsp + 0x68], rdx
cmp rdx, rsi
je 0x100002fc1
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp ebx, esi
je 0x100002fc1
cmp dword [rsp + 0x60], esi
jne 0x100002fc3
mov edi, esi
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.10000a940
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x100003958
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
mov eax, dword [r9]
mov rcx, qword [rcx]
mov rbx, r8
add eax, eax
mov rdi, r9
xor esi, esi
mov dword [rsp + 0x30], eax
lea rax, [r11 - 0x18]
mov dword [r9], esi
mov qword [r11 - 0x20], rax
lea r9, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1000039db
cmp dword [rsp + 0x68], 1
je 0x1000039b1
cmp dword [rsp + 0x68], 2
je 0x1000039b1
mov eax, 0xd
jmp 0x1000039db
mov ecx, dword [rsp + 0x30]
cmp rbx, rsi
je 0x1000039d5
cmp ecx, esi
je 0x1000039d2
test cl, 1
jne 0x1000039aa
mov rax, rcx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x1000039d5
jmp 0x1000039aa
mov word [rbx], si
shr ecx, 1
xor eax, eax
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x100003d8c
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x10000f130]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x30]
lea rdx, [0x100001d40]
mov r8d, 0x40
call sub.msvcrt.dll_memcpy
mov ecx, 0x248
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x100003dd3
mov rcx, rax
jmp 0x100003e2a
lea rcx, [rsp + 0x30]
mov r8d, 0x124
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x100003e27
cmp eax, 0x124
ja 0x100003e27
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [0x100001d80]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
cmp rax, 0x20
jle 0x100003e2a
call qword [sym.imp.msvcrt.dll_free]
mov eax, 1
jmp 0x100003e32
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.10000a940
add rsp, 0x80
pop rbx
ret
Function at 0x1000051b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x10000f4c0]
xor edx, edx
xor ebx, ebx
call fcn.10000a1e0
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x10000529e
test rbx, rbx
jne 0x1000052aa
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x10000528d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10000523a
xor ebx, ebx
jmp 0x100005288
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100005236
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x100005277
cmp rdi, r11
jae 0x100005236
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100005265
cmp rdi, r11
jae 0x100005236
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x1000052ac
lea rcx, [0x10000f4c0]
mov edx, ebp
call fcn.10000a1e0
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x1000051f7
xor esi, esi
test rsi, rsi
jne 0x1000052b5
xor eax, eax
jmp 0x1000052c3
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.1000052e8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1000052e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x10000545e
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10000545e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10000545e
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x100005394
cmp rdi, r11
jae 0x10000545e
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10000537e
cmp rdi, r11
jae 0x10000545e
cmp word [rdi], r13w
je 0x10000545e
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1000053c6
mov edx, ebx
mov rcx, rsi
call fcn.100005554
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1000053e7
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
je 0x100005436
cmp eax, 0xc
je 0x10000542b
cmp eax, 0x16
je 0x100005420
cmp eax, 0x22
je 0x100005420
cmp eax, 0x50
je 0x100005436
mov ecx, 0x80004005
call fcn.100003a64
int3
mov ecx, 0x80070057
call fcn.100003a64
int3
mov ecx, 0x8007000e
call fcn.100003a64
int3
cmp ebx, r13d
jl 0x100005453
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x100005453
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x100005460
mov ecx, 0x80070057
call fcn.100003a64
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1000058f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0xe0
mov rax, qword [0x10000f130]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x48]
mov rbx, rcx
lea rdx, [0x1000020c0]
xor edi, edi
mov r9d, 0x20019
xor r8d, r8d
and qword [rsp + 0x48], rdi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100005ac6
mov rdi, qword [rsp + 0x48]
xor ebp, ebp
and qword [rsp + 0x38], rbp
and qword [rsp + 0x30], rbp
and qword [rsp + 0x28], rbp
and qword [rsp + 0x20], rbp
xor edx, edx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x40], 0x40
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x100005ac6
lea rcx, [rsp + 0x50]
call fcn.100008aa0
mov rsi, rax
test rax, rax
je 0x100005a9a
cmp qword [rbx + 0xc0], 0
mov r12, qword [rbx + 0xa8]
jne 0x100005a52
mov ecx, dword [rbx + 0xc8]
test rcx, rcx
je 0x1000059e0
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 0x18
jb 0x100005a16
lea rcx, [rcx + rcx*2]
shl rcx, 3
or rax, 0xffffffffffffffff
sub rax, rcx
cmp rax, 8
jb 0x100005a16
add rcx, 8
call qword [sym.imp.msvcrt.dll_malloc]
mov r11, rax
test rax, rax
je 0x100005abb
mov rcx, qword [rbx + 0xb8]
mov qword [rax], rcx
mov qword [rbx + 0xb8], rax
jmp 0x100005a19
xor r11d, r11d
test r11, r11
je 0x100005abb
mov edx, dword [rbx + 0xc8]
lea eax, [rdx - 1]
dec edx
lea rax, [rax + rax*2]
lea rcx, [r11 + rax*8 + 8]
js 0x100005a52
mov rax, qword [rbx + 0xc0]
mov qword [rcx], rax
mov qword [rbx + 0xc0], rcx
sub rcx, 0x18
sub edx, 1
jns 0x100005a38
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rax]
test rax, rax
je 0x100005a65
mov qword [rax + 0x10], rsi
mov qword [rbx + 0xc0], rcx
and qword [rax], 0
mov qword [rax + 8], r12
mov rcx, qword [rbx + 0xa8]
inc qword [rbx + 0xb0]
test rcx, rcx
je 0x100005a8c
mov qword [rcx], rax
jmp 0x100005a93
mov qword [rbx + 0xa0], rax
mov qword [rbx + 0xa8], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
inc ebp
and qword [rsp + 0x20], 0
mov edx, ebp
jmp 0x10000596d
mov ecx, 0x8007000e
call fcn.100003a64
int3
test rdi, rdi
je 0x100005ad4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbx + 0xa0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.10000a940
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x100006abc
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x68], 0
lea rax, [r11 + 0x10]
mov rbx, rcx
mov qword [r11 - 0x28], rax
lea rax, [0x100002180]
mov qword [r11 - 0x20], rax
lea rsi, [0x10000f150]
cmp qword [0x10000f150], rsi
je 0x100006afa
lea rcx, [r11 - 0x28]
call fcn.100002cbc
mov rcx, rbx
call fcn.1000075d8
test eax, eax
je 0x100006c6f
mov rax, qword [0x10000f100]
lea rcx, [0x10000f100]
call qword [rax + 0x18]
lea rdx, [rsp + 0x78]
mov r8, rbx
add rax, 0x18
mov rcx, rbx
mov qword [rsp + 0x78], rax
call fcn.100006f60
lea rax, [rsp + 0x70]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
xor edi, edi
mov r9d, 0x20006
and qword [rsp + 0x70], rdi
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100006b6b
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
test eax, eax
je 0x100006bc7
movzx r8d, ax
or r8d, 0x80070000
test eax, eax
cmovle r8d, eax
mov dword [rsp + 0x68], r8d
mov rcx, qword [0x10000f150]
cmp rcx, rsi
je 0x100006c46
test byte [rcx + 0x1c], 8
je 0x100006c46
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r9, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
lea r8, [0x100001940]
mov edx, 0x12
call fcn.100005cf8
jmp 0x100006c46
test rbx, rbx
jne 0x100006bd7
mov ecx, 0x80004005
call fcn.100003a64
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.Configuration
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100006c1c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x68], ecx
mov rcx, qword [0x10000f150]
cmp rcx, rsi
je 0x100006c46
test byte [rcx + 0x1c], 0x10
je 0x100006c46
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001940]
mov edx, 0x13
mov r9, rbx
call fcn.100002b98
test rdi, rdi
je 0x100006c54
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x100006c6f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, dword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.100002cfc
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000072f8
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
lea rax, [r11 + 0x10]
xor r12d, r12d
mov rbp, r8
mov qword [r11 - 0x28], rax
lea rax, [0x100002270]
mov rsi, rdx
mov qword [r11 - 0x20], rax
mov dword [r11 + 0x10], r12d
lea r13, [0x10000f150]
cmp qword [0x10000f150], r13
je 0x100007349
lea rcx, [r11 - 0x28]
call fcn.100002cbc
cmp rsi, r12
je 0x100007508
cmp word [rsi], r12w
je 0x100007508
mov edx, 0x7fffffff
mov rcx, rsi
mov rax, rdx
cmp word [rcx], r12w
je 0x100007377
add rcx, 2
sub rax, 1
jne 0x100007367
cmp rax, r12
je 0x1000074f5
sub rdx, rax
lea rdi, [rdx + 0x104]
cmp rdi, rdx
jb 0x1000074f5
cmp rdi, r12
jne 0x10000739d
mov rcx, r12
jmp 0x1000073b4
xor edx, edx
or rax, 0xffffffffffffffff
div rdi
cmp rax, 2
jb 0x1000074e6
lea rcx, [rdi + rdi]
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
cmp rax, r12
je 0x1000074e6
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
cmp eax, r12d
jne 0x10000740a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x30]
call fcn.100002cfc
movzx eax, di
or eax, 0x80070000
cmp edi, r12d
cmovle eax, edi
jmp 0x100007517
cmp rsi, rdi
jbe 0x10000742c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x30]
call fcn.100002cfc
mov eax, 0x8007007a
jmp 0x100007517
mov r9, rbp
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
mov rdi, rax
jg 0x1000074cf
mov rcx, qword [0x10000f150]
cmp rcx, r13
je 0x100007480
test byte [rcx + 0x1c], 8
je 0x100007480
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001940]
mov edx, 0x17
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.100005cf8
cmp rdi, 2
jl 0x1000074b5
cmp rdi, 3
jle 0x100007492
cmp rdi, 0xb
jne 0x1000074b5
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x30]
call fcn.100002cfc
movzx eax, si
or eax, 0x80070000
cmp esi, r12d
cmovle eax, esi
jmp 0x100007517
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x30]
call fcn.100002cfc
mov eax, 0x80004005
jmp 0x100007517
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rsp + 0x30]
call fcn.100002cfc
xor eax, eax
jmp 0x100007517
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_free]
mov ebx, 0x8007000e
jmp 0x1000074fa
mov ebx, 0x80004005
lea rcx, [rsp + 0x30]
call fcn.100002cfc
mov eax, ebx
jmp 0x100007517
lea rcx, [rsp + 0x30]
call fcn.100002cfc
mov eax, 0x80070057
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x1000075d8
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x10000f130]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor esi, esi
lea rax, [r11 - 0x20]
lea rcx, [r11 - 0x18]
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
lea ebx, [rsi + 1]
lea r8d, [rsi + 4]
xor r9d, r9d
mov dl, bl
mov dword [rsp + 0x28], esi
mov edi, esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x20], esi
mov byte [rsp + 0x70], sil
mov byte [rsp + 0x71], sil
mov byte [rsp + 0x72], sil
mov byte [rsp + 0x73], sil
mov byte [rsp + 0x74], sil
mov byte [rsp + 0x75], 5
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
neg eax
sbb rdx, rdx
and rdx, qword [rsp + 0x68]
mov qword [rsp + 0x68], rdx
cmp rdx, rsi
je 0x100007684
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [0x10000f150]
lea rax, [0x10000f150]
cmp rcx, rax
je 0x1000076c2
test byte [rcx + 0x1c], 0x10
je 0x1000076c2
cmp edi, esi
je 0x1000076aa
mov r9d, ebx
cmp dword [rsp + 0x60], esi
jne 0x1000076ad
mov r9d, esi
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001940]
mov edx, 0x18
call fcn.100005d94
cmp edi, esi
je 0x1000076cc
cmp dword [rsp + 0x60], esi
jne 0x1000076ce
mov ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.10000a940
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x100007bd4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
xor r15d, r15d
mov r13, rdx
lea rax, [rsp + 0x38]
mov word [rdx], r15w
mov rbp, r9
mov r14, rcx
lea rdx, [0x100001b00]
xor r8d, r8d
mov r9d, 0x2001f
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x100007d97
mov rcx, qword [rbp]
mov eax, r15d
cmp rcx, r15
je 0x100007c4e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], r15
mov rcx, qword [rsp + 0x38]
mov qword [rbp], rcx
cmp eax, r15d
jne 0x100007d97
lea rcx, [rsp + 0x40]
call fcn.100005634
lea rcx, [rsp + 0x40]
call fcn.1000058f0
mov rbx, qword [rax]
jmp 0x100007d84
mov r12, qword [rbx + 0x10]
mov rbx, qword [rbx]
lea rdi, [0x100001ef0]
mov rsi, qword [r12 + 0x28]
mov ecx, 0xe
repe cmpsw word [rsi], word [rdi]
je 0x100007d84
mov rdx, qword [r12]
mov rcx, qword [rbp]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x148]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x100007d84
cmp dword [rsp + 0x38], 4
jne 0x100007d84
mov eax, r15d
cmp eax, r15d
jne 0x100007d84
mov eax, dword [rsp + 0x148]
test al, 2
je 0x100007d46
and eax, 0xfffffffd
mov dword [r14 + 0x98], 1
mov rcx, qword [rbp]
mov dword [rsp + 0x148], eax
mov rdx, qword [r12]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rsp + 0x148]
test al, 1
je 0x100007d84
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x100007d73
lea r8, [0x1000021e4]
mov edx, 0x400
mov rcx, r13
call fcn.100005c34
mov r8, qword [r12]
mov edx, 0x400
mov rcx, r13
call fcn.100005c34
cmp rbx, r15
jne 0x100007c7c
lea rcx, [rsp + 0x40]
call fcn.100005760
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret