joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000c3ce
mov word [rbp + 0x50], 0x686f
mov word [rbp + 0x58], 0x686f
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c254
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000c240
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000c285
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000c270
cmp rdi, rbx
jne 0x14000c3a2
mov r13, rsi
mov word [rbp - 0x50], 0x686f
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c2c6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000c2b2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000c3c8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x68000e
call fcn.140002520
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000c338
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x680015
call fcn.140002520
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000c338
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x68000e
mov dword [rbp - 0x42], 0x68002e
call fcn.140002520
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002520
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x68000e
call fcn.140002520
movzx eax, word [rax]
cmp edi, eax
jl 0x14000c395
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x680015
call fcn.140002520
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000c395
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x68000e
mov dword [rbp - 0x32], 0x68002e
call fcn.140002520
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002520
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000c3a2
inc r14
jmp 0x14000c2a0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000c3ce
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000c210
mov rax, qword [rbp - 8]
jmp 0x14000c3d0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6e
mov dword [rbp - 0x20], 0x2d0024
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x270036
mov dword [rbp - 0x18], 0x1a0003
mov dword [rbp - 0x14], 0x310037
mov dword [rbp - 0x10], 0x1f0030
call fcn.140004d70
mov rcx, rax
call 0x14000c4f0
mov qword [0x1400101b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x63
mov dword [rbp - 0x20], 0x2d0024
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x270036
mov dword [rbp - 0x18], 0x1a0003
mov dword [rbp - 0x14], 0x420046
call fcn.140002330
mov rcx, rax
call 0x14000c4f0
lea rcx, [rbp - 0x20]
mov qword [0x1400101a8], rax
mov dword [rbp - 0x20], 0x1c0001
mov dword [rbp - 0x1c], 0x50000
mov dword [rbp - 0x18], 0x56002a
call fcn.140004c00
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000c4f0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c552
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.140008d70
test al, al
jne 0x14000c564
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000c520
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c4f0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6e
mov dword [rbp - 0x20], 0x2d0024
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x270036
mov dword [rbp - 0x18], 0x1a0003
mov dword [rbp - 0x14], 0x310037
mov dword [rbp - 0x10], 0x1f0030
call fcn.140004d70
mov rcx, rax
call 0x14000c4f0
mov qword [0x1400101b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x63
mov dword [rbp - 0x20], 0x2d0024
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x270036
mov dword [rbp - 0x18], 0x1a0003
mov dword [rbp - 0x14], 0x420046
call fcn.140002330
mov rcx, rax
call 0x14000c4f0
lea rcx, [rbp - 0x20]
mov qword [0x1400101a8], rax
mov dword [rbp - 0x20], 0x1c0001
mov dword [rbp - 0x1c], 0x50000
mov dword [rbp - 0x18], 0x56002a
call fcn.140004c00
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000c4f0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c552
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.140008d70
test al, al
jne 0x14000c564
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000c520
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000cac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400101c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x3c
mov dword [rbp - 0x1c], 0x50001
mov dword [rbp - 0x18], 0x65002a
mov dword [rbp - 0x14], 0x5e0047
mov dword [rbp - 0x10], 0x360007
mov dword [rbp - 0xc], 0x670002
call fcn.140002a50
mov rcx, rax
call rbx
mov rbx, qword [0x1400101c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400101a0], rax
mov dword [rbp - 0x20], 0x10038
mov dword [rbp - 0x1c], 0xa
mov dword [rbp - 0x18], 0x330028
mov dword [rbp - 0x14], 0x5e0001
mov dword [rbp - 0x10], 0x360007
mov dword [rbp - 0xc], 0x670002
call fcn.140002a50
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x14000edb0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400101b0], rax
mov word [rbp - 0x10], 0x3618
mov byte [rbp - 0xe], 0x76
call fcn.1400043c0
mov rcx, qword [0x1400101a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140010130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x501003c
mov dword [rbp - 0x1c], 0x150d132a
mov dword [rbp - 0x18], 0x21a2f00
mov word [rbp - 0x14], 0x761a
call fcn.140001180
mov rcx, qword [0x1400101a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140010130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xc100626
mov dword [rbp - 0x1c], 0x4103834
mov dword [rbp - 0x18], 0x90b2a2c
mov word [rbp - 0x14], 0x760c
call fcn.140001180
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000ed10]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100e8], rax
mov byte [rbp - 0x10], 0x6e
call fcn.1400014c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000ee10]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100f0], rax
mov dword [rbp - 0x10], 0x47130d0a
call fcn.1400026f0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000ede0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100e0], rax
mov byte [rbp - 0x10], 0x6e
call fcn.1400014c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000ee60]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100d8], rax
mov dword [rbp - 0x10], 0x6180e07
mov byte [rbp - 0xc], 0x7a
call fcn.1400031c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000ee00]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2000
mov byte [rbp - 0xe], 0x76
call fcn.1400043c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x140003a40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1400b9560], 0
je 0x14001be96
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call sym.spoolsv.exe_PrvRevertToPrinterSelf
xor edx, edx
lea r8, str.RouterPreInitEvent
mov rdi, rax
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14001bf2c
mov rax, qword [0x1400b72f8]
lea rcx, [0x1400b72f8]
cmp rax, rcx
je 0x14001bf00
test byte [rax + 0x44], 0x20
je 0x14001bf00
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400b72f8]
lea edx, [rbx + 0x15]
mov r9d, eax
lea r8, [0x14009cb20]
mov rcx, qword [rcx + 0x38]
call fcn.1400307d8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rcx, [0x14009b6e8]
mov edx, eax
call fcn.140053388
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test rdi, rdi
je 0x14001bf73
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x14001bf73
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
mov ecx, 0x69
call fcn.140052f80
or edx, 0xffffffff
call fcn.14005856c
nop
jmp 0x140003a57
Function at 0x14000a030
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14002a0bf
cmp dword [rcx], 0x6060
jne 0x14002a0bf
mov rax, qword [0x1400b9558]
cmp qword [rcx + 8], rax
jne 0x14002a036
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax + 0x2b0]
call qword [0x140098d58]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x14002a0b5
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
or qword [rbx + 0x38], 0xffffffffffffffff
cmp qword [rbx + 0x40], 0
je 0x14002a0b5
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rcx, qword [rbx + 0x40]
mov rdi, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14002a08a
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
test rdi, rdi
je 0x14002a097
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400b9518]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
and qword [rbx + 0x40], 0
mov eax, 1
jmp 0x14000a074
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x14000a074
Function at 0x14000bf88
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400b77a8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebp, ebp
mov rsi, rcx
mov qword [rsp + 0x38], rbp
mov ebx, ebp
test rcx, rcx
je 0x14000c0f4
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x14000bfca
inc rax
cmp rax, 0x207
jae 0x14000c0f4
mov ecx, 0x438
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
je 0x14000c0f4
lea rcx, [rsp + 0x40]
call fcn.14000c258
lea r8, str.PrintersConnections
mov edx, 0x21c
mov rcx, rdi
call fcn.14000c210
mov eax, 0x5c
lea rdx, [rdi + 0x2a]
mov r8d, 0x207
mov word [rdi + 0x28], ax
mov rcx, rsi
call sym.spoolsv.exe_PrvFormatPrinterForRegistryKey
mov ecx, 0x20019
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov rsi, rax
test rax, rax
je 0x14000c0d2
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c0c3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14009a9a0]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14002a316
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [0x1400b9518]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.14000c128
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140013430
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rbx, qword [0x1400b9558]
jmp 0x14002a33f
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000c0b2
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14002a31f
jmp 0x14000c0b2

Function at 0x14000c128
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx]
mov rbx, rcx
cmp rdx, 0xffffffffffffffff
je 0x14000c155
test rdx, rdx
je 0x14000c155
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x14002a34a
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000c5c0
mov ecx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
Function at 0x14000da20
Capabilities:
Get thread local storage value
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400b77a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [0x1400b9550]
xor esi, esi
mov edi, eax
cmp ecx, 0xffffffff
je 0x14002ccaa
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqTransportType]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000dbab
cmp dword [rsp + 0x60], 4
jne 0x14002ccc8
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
mov ebx, 1
lea r9, [rsp + 0x70]
mov rcx, rax
mov r8d, ebx
lea edx, [rbx + 7]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x14000dbba
lea rax, [rsp + 0x68]
mov dword [rsp + 0x78], esi
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 1]
mov dword [rsp + 0x48], esi
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
movzx edx, bl
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x7c], 0x500
mov qword [rsp + 0x68], rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x14002ccde
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x64]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x14002ccd2
cmp dword [rsp + 0x64], esi
jne 0x14000db4b
mov ebx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test ebx, ebx
js 0x14002ccea
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140013430
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
cmp eax, 0x6bd
jne 0x14002ccb2
mov ebx, esi
jmp 0x14000db6d
call fcn.14000dcf4
mov ebx, eax
cmp eax, 0x800703f0
je 0x14000dbb6
jmp 0x14000db6d
mov rax, rsi
jmp 0x14000da6f
test eax, eax
jle 0x14000db6d
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000db6d
mov ebx, 1
jmp 0x14000db6d
call fcn.14000dcf4
mov ebx, eax
jmp 0x14000db4b
call fcn.14000dcf4
mov ebx, eax
jmp 0x14000db5c
mov rcx, qword [0x1400b72f8]
lea rax, [0x1400b72f8]
cmp rcx, rax
je 0x14000db83
test byte [rcx + 0x44], 0x20
je 0x14000db83
mov rcx, qword [rcx + 0x38]
lea r8, [0x14009cc08]
mov edx, 0x12
mov r9d, ebx
call fcn.1400307d8
nop
jmp 0x14000db83
Function at 0x14000e5d4
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
xor edi, edi
lea rcx, [rbp - 0x50]
mov qword [rbp + 0x30], rdi
mov rsi, rdx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rax, [rbp - 0x50]
mov dword [rbp - 0x30], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r9d, [rdi + 8]
mov qword [rbp - 0x28], rbx
lea r8, [rbp - 0x30]
mov dword [rbp - 0x18], 0x140
mov edx, 0x2000000
lea rcx, [rbp + 0x30]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKeyEx]
nop dword [rax + rax]
test eax, eax
js 0x14000e69b
lea rdx, str.SymbolicLinkValue
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r8d, [rdi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
cmp eax, 0xc0000034
jne 0x14000e6b1
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xa8]
mov eax, edi
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
cmp dword [rbp + 0x20], edi
jbe 0x14000e68b
jmp 0x14002abae
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
test eax, eax
mov ecx, 1
cmovns edi, ecx
mov rcx, qword [0x1400b72f8]
lea rax, [0x1400b72f8]
cmp rcx, rax
je 0x14000e68b
test byte [rcx + 0x44], 0x20
je 0x14000e68b
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400ac5d0]
mov edx, 0xa
mov r9, rsi
call fcn.140040ed0
nop
jmp 0x14000e68b
Function at 0x14000e9c0
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400b77a8]
xor rax, rsp
mov qword [rbp - 8], rax
and dword [rbp - 0x1c], 0
lea rdi, [rcx + 8]
and qword [rbp - 0x18], 0
lea rdx, str.Printers
mov rbx, rcx
mov rcx, qword [rdi]
call fcn.14000e5d4
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x18]
mov rcx, qword [rdi]
lea rdx, str.Printers
mov qword [rsp + 0x38], rax
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov dword [rbp - 0x20], eax
test eax, eax
jne 0x14002b39c
mov rcx, qword [rbp - 0x18]
call fcn.14000e10c
mov dword [rbp - 0x20], eax
test eax, eax
jne 0x14002b39c
lea rcx, [rbp - 0x18]
call fcn.140012d98
cmp dword [0x1400b9560], 0
je 0x14002b3db
mov rcx, qword [rbx]
call fcn.14000ffdc
test eax, eax
jne 0x14000eb37
mov rdx, rdi
xor ecx, ecx
call fcn.14000e34c
test eax, eax
je 0x14000eae4
mov edx, 1
mov rcx, rdi
call fcn.14000ec04
mov rcx, qword [rbx]
lea rax, [rbp - 0x10]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
xor eax, eax
mov dword [rbp - 0x10], eax
call fcn.1400106a0
test eax, eax
js 0x14000ead7
lea rdx, str._Classes
lea rcx, [rbp - 0x18]
call fcn.140010aa0
test eax, eax
js 0x14000ead7
mov rcx, qword [rbp - 0x18]
call fcn.14000f578
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x18]
call fcn.140010ca0
and qword [rsp + 0x20], 0
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 3]
call sym.spoolsv.exe_PrvRouterBroadcastMessage
mov rcx, qword [rbx]
lea rax, [rbp - 0x20]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x1c]
lea edx, [r9 + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x14000eb37
mov r8d, dword [rbp - 0x1c]
mov edx, 1
mov ecx, edx
mov r9, rbx
call fcn.14000c70c
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14002b3f8
mov rcx, rdi
call fcn.14000eb88
mov rcx, qword [0x1400b9518]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140013430
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov rcx, qword [0x1400b72f8]
lea rdx, [0x1400b72f8]
cmp rcx, rdx
je 0x14000ea5c
test byte [rcx + 0x44], 0x20
je 0x14000ea5c
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400ac5d0]
mov edx, 0xd
mov r9d, eax
call fcn.1400307d8
nop
jmp 0x14000ea5c
mov edx, 0x1d4c0
call fcn.14005856c
test eax, eax
jns 0x14000ea72
call sym.spoolsv.exe_PrvWaitForSpoolerInitialization
nop
jmp 0x14000ea72
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x14000eb43