joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsApointUSBMouseExceptions
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001129
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
xor ebp, ebp
mov qword [rsp + 0x280], r12
lea r12, [0x140017e40]
mov esi, ebp
mov ebx, ebp
mov rdi, r12
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov edx, esi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400010f0
cmp dword [rsp + 0x40], 4
jne 0x1400010e3
mov eax, dword [rsp + 0x44]
add ebx, 1
add rdi, 4
mov dword [rdi - 4], eax
add esi, 1
cmp ebx, 0x100
jb 0x140001080
jmp 0x1400010f6
mov eax, ebx
mov dword [r12 + rax*4], ebp
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400049a0
add rsp, 0x288
ret

Function at 0x1400019f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsApointUSBMouse
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001b0f
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
xor ebp, ebp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x280], rdi
mov dword [0x140018240], ebp
mov ebx, ebp
nop
nop
nop
nop
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov edx, ebx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rsi, str.BluetoothMouseEnable
lea rdi, [rsp + 0x60]
mov ecx, 0x15
repe cmpsw word [rsi], word [rdi]
je 0x140001ada
add ebx, 1
cmp ebx, 7
jb 0x140001a70
jmp 0x140001ae4
mov eax, dword [rsp + 0x40]
mov dword [0x140018240], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400049a0
add rsp, 0x288
ret
Function at 0x140001bc0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
xor edi, edi
mov edx, 0x104
mov rbx, rdi
mov dword [rsp + 0x20], 0x5c
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x30]
test r11, r11
je 0x140001c3e
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.140005120
lea r8, str.kernel32.dll
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.140005120
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rbx, rbx
mov qword [0x1400183d0], rbx
jne 0x140001c4e
xor eax, eax
jmp 0x140001c6e
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400183f0], rax
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400049a0
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret

Function at 0x140002090
Capabilities:
Get session information
Get session user name

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
call qword [0x1400183f0]
lea r9, [rsp + 0x58]
mov edi, eax
lea rax, [rsp + 0x50]
lea r8d, [rbx + 8]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
lea r9, [rsp + 0x60]
lea r8d, [rbx + 5]
mov esi, eax
lea rax, [rsp + 0x50]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140002115
test esi, esi
mov r8, qword [rsp + 0x60]
je 0x14000210d
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x14000210d
mov rdx, qword [rsp + 0x58]
mov eax, 1
cmp dword [rdx], ebx
cmove ebx, eax
mov rcx, r8
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
je 0x140002123
mov rcx, qword [rsp + 0x58]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002130
Capabilities:
Get session information

Disassembly:
sub rsp, 0x48
cmp dword [0x140016ef4], 0
jne 0x140002144
xor eax, eax
add rsp, 0x48
ret
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov ebx, ebp
call qword [0x1400183f0]
lea r9, [rsp + 0x58]
lea r8d, [rbp + 8]
mov edi, eax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov edx, edi
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
lea r9, [rsp + 0x60]
lea r8d, [rbp + 5]
mov esi, eax
lea rax, [rsp + 0x50]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x1400021d7
test esi, esi
mov rdx, qword [rsp + 0x60]
je 0x1400021cf
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1400021cf
mov rax, qword [rsp + 0x58]
mov ecx, 1
cmp dword [rax], ebx
cmove ebx, ecx
mov rcx, rdx
call sub.WTSAPI32.dll_WTSFreeMemory
mov rdi, qword [rsp + 0x30]
test esi, esi
mov rsi, qword [rsp + 0x38]
je 0x1400021ef
mov rcx, qword [rsp + 0x58]
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [0x140016ef4]
cmp ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x68]
cmove ecx, ebp
mov rbp, qword [rsp + 0x40]
mov dword [0x140016ef4], ecx
add rsp, 0x48
ret
Function at 0x1400032f0
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor esi, esi
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov ebx, esi
mov rdi, rsi
mov dword [rsp + 0x30], 0x5c
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x60]
test r11, r11
je 0x140003375
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov edx, 0x208
call fcn.140005120
lea r8, str.VXDIF.DLL
lea rcx, [rsp + 0x60]
mov edx, 0x208
call fcn.140005120
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rdi, rdi
mov qword [0x1400183c8], rdi
je 0x14000352c
lea rdx, str.IOCTL_SetTouchPadDisable
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400183c8]
lea rdx, str.Alps_DisableTouchpad
mov qword [0x140018400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400183c8]
lea rdx, str.Alps_MouseGetInitStatus
mov qword [0x1400183f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140018400], rbx
mov qword [0x140018408], rax
je 0x1400033ef
cmp qword [0x1400183f8], rbx
je 0x1400033ef
mov ecx, 1
test rax, rax
cmovne ebx, ecx
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400034b4
lea rax, [rsp + 0x48]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000348d
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
lea rdx, str.SupportI2CToPS2Switch
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
lea rdx, str.SupportI2CToPS2Switch
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x1400034f4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, esi
jmp 0x1400034ff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
test r11d, r11d
mov dword [0x1400183e0], r11d
je 0x14000352c
mov rcx, qword [0x1400183c8]
lea rdx, str.IOCTL_SetPS2Mode
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140018410], rax
cmove ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400049a0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140003dd0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rcx, str.Tobby_:______LaunchCloseApp_enter_
call fcn.140001b60
lea r8, str.HomeDirectory
lea rdx, str.SOFTWAREAlpsApoint
mov rcx, 0xffffffff80000002
call fcn.140004580
mov ebx, 0x104
lea rcx, [rsp + 0x230]
mov r8, rbx
movzx edx, word [rax]
test dx, dx
je 0x140003e3c
mov word [rcx], dx
add rcx, 2
add rax, 2
sub r8, 1
jne 0x140003e21
jmp 0x140003e41
test r8, r8
jne 0x140003e45
sub rcx, 2
mov word [rcx], 0
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea rax, [rsp + 0x20]
sub r8, rcx
movzx ecx, word [r8 + rax]
test cx, cx
je 0x140003e7b
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140003e62
jmp 0x140003e80
test rdx, rdx
jne 0x140003e84
sub rax, 2
mov word [rax], 0
mov rcx, rbx
lea rax, [rsp + 0x20]
cmp word [rax], 0
je 0x140003ea3
add rax, 2
sub rcx, 1
jne 0x140003e91
jmp 0x140003eec
test rcx, rcx
je 0x140003eec
mov rax, rbx
mov rdx, rbx
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0x20]
je 0x140003eec
lea r8, str.ApClose.exe
sub r8, rcx
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140003ede
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140003ec5
jmp 0x140003ee3
test rdx, rdx
jne 0x140003ee7
sub rcx, 2
mov word [rcx], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140003f86
lea r8, str.C:Program_FilesApoint2K
lea rcx, [rsp + 0x230]
mov rdx, rbx
sub r8, rcx
lea rax, [rsp + 0x230]
nop
movzx ecx, word [r8 + rax]
test cx, cx
je 0x140003f39
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140003f20
jmp 0x140003f3e
test rdx, rdx
jne 0x140003f42
sub rax, 2
lea rdx, str.C:Program_FilesApoint2KApClose.exe
lea rcx, [rsp + 0x20]
mov word [rax], 0
sub rdx, rcx
lea rax, [rsp + 0x20]
nop
nop
movzx ecx, word [rdx + rax]
test cx, cx
je 0x140003f78
mov word [rax], cx
add rax, 2
sub rbx, 1
jne 0x140003f60
jmp 0x140003f7d
test rbx, rbx
jne 0x140003f81
sub rax, 2
mov word [rax], 0
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r9d, 1
xor edx, edx
call fcn.1400041e0
lea rcx, str.Tobby_:______LaunchCloseApp_exit_
call fcn.140001b60
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400049a0
add rsp, 0x450
pop rbx
ret
Function at 0x140003fd0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rcx, str.Tobby_:______LaunchApointExe_enter_
call fcn.140001b60
lea r8, str.HomeDirectory
lea rdx, str.SOFTWAREAlpsApoint
mov rcx, 0xffffffff80000002
call fcn.140004580
mov ebx, 0x104
lea rcx, [rsp + 0x230]
mov r8, rbx
movzx edx, word [rax]
test dx, dx
je 0x14000403c
mov word [rcx], dx
add rcx, 2
add rax, 2
sub r8, 1
jne 0x140004021
jmp 0x140004041
test r8, r8
jne 0x140004045
sub rcx, 2
mov word [rcx], 0
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea rax, [rsp + 0x20]
sub r8, rcx
movzx ecx, word [r8 + rax]
test cx, cx
je 0x14000407b
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140004062
jmp 0x140004080
test rdx, rdx
jne 0x140004084
sub rax, 2
mov word [rax], 0
mov rcx, rbx
lea rax, [rsp + 0x20]
cmp word [rax], 0
je 0x1400040a3
add rax, 2
sub rcx, 1
jne 0x140004091
jmp 0x1400040ec
test rcx, rcx
je 0x1400040ec
mov rax, rbx
mov rdx, rbx
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0x20]
je 0x1400040ec
lea r8, str.Apoint.exe
sub r8, rcx
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400040de
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400040c5
jmp 0x1400040e3
test rdx, rdx
jne 0x1400040e7
sub rcx, 2
mov word [rcx], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140004186
lea r8, str.C:Program_FilesApoint2K
lea rcx, [rsp + 0x230]
mov rdx, rbx
sub r8, rcx
lea rax, [rsp + 0x230]
nop
movzx ecx, word [r8 + rax]
test cx, cx
je 0x140004139
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140004120
jmp 0x14000413e
test rdx, rdx
jne 0x140004142
sub rax, 2
lea rdx, str.C:Program_FilesApoint2KApoint.exe
lea rcx, [rsp + 0x20]
mov word [rax], 0
sub rdx, rcx
lea rax, [rsp + 0x20]
nop
nop
movzx ecx, word [rdx + rax]
test cx, cx
je 0x140004178
mov word [rax], cx
add rax, 2
sub rbx, 1
jne 0x140004160
jmp 0x14000417d
test rbx, rbx
jne 0x140004181
sub rax, 2
mov word [rax], 0
mov ecx, dword [0x1400183dc]
test ecx, ecx
je 0x140004196
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r9d, 1
xor edx, edx
call fcn.1400043a0
lea rcx, str.Tobby_:______LaunchApointExe_exit_
call fcn.140001b60
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400049a0
add rsp, 0x450
pop rbx
ret
Function at 0x1400041e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x510
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov rsi, rcx
lea rcx, str.CreateProcessWithLowPriv_WaitProccess_:_enter_n
xor ebx, ebx
mov rbp, r8
mov qword [rsp + 0x68], rbx
call fcn.140001b60
xor ecx, ecx
lea r8d, [rbx + 0x68]
xor edx, edx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rcx
lea rcx, [rsp + 0x90]
call fcn.140009ce0
lea rax, str.winsta0default
lea rcx, [rsp + 0x102]
xor edx, edx
mov r8d, 0x3fe
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x90], 0x68
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x100], bx
call fcn.140009ce0
call qword [0x1400183f0]
lea rdx, [rsp + 0x60]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov r9, qword [rsp + 0x60]
lea rdx, str.GetCurrentSessionToken_Return_d__Token_p__n
lea rcx, [rsp + 0x100]
movzx r8d, al
call fcn.140001b30
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x14000436e
lea rcx, [rsp + 0x68]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x14000436e
lea rcx, str.CreateProcessWithLowPriv_WaitProccess_____1_Get_Token_success__AppName_s__Cmd_s
xor r8d, r8d
mov rdx, rsi
call fcn.140001b60
lea rcx, [rsp + 0x70]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
xor r9d, r9d
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, qword [rsp + 0x70]
or edx, 0xffffffff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000435d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000436e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.CreateProcessWithLowPriv_WaitProccess_:_exit_n
call fcn.140001b60
mov eax, ebx
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.1400049a0
mov rbx, qword [rsp + 0x538]
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400043a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x910
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x900], rax
mov rsi, rcx
mov rbp, r8
lea rcx, [rsp + 0x102]
xor ebx, ebx
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x100], bx
call fcn.140009ce0
xor eax, eax
lea r8d, [rbx + 0x68]
lea rcx, [rsp + 0x90]
xor edx, edx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
call fcn.140009ce0
lea rax, str.winsta0default
lea rcx, [rsp + 0x502]
xor edx, edx
mov r8d, 0x3fe
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x90], 0x68
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x500], bx
call fcn.140009ce0
call qword [0x1400183f0]
lea rdx, [rsp + 0x60]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov r9, qword [rsp + 0x60]
lea rdx, str.GetCurrentSessionToken_Return_d__Token_p__n
lea rcx, [rsp + 0x500]
movzx r8d, al
call fcn.140001b30
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x14000453f
lea rcx, [rsp + 0x68]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x14000453f
lea rdx, str.CreateProcessWithLowPriv___Get_Token_success__AppName_s__Cmd_s
lea rcx, [rsp + 0x100]
xor r9d, r9d
mov r8, rsi
call fcn.140001b30
lea r11, [rsp + 0x70]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000452e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000453f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.CreateProcessWithLowPriv___Ret_d
lea rcx, [rsp + 0x100]
mov r8d, ebx
call fcn.140001b30
mov eax, ebx
mov rcx, qword [rsp + 0x900]
xor rcx, rsp
call fcn.1400049a0
mov rbx, qword [rsp + 0x938]
add rsp, 0x910
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004580
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], 0
call fcn.140009ce0
lea rbx, [0x140018420]
lea rdx, [0x140012ebc]
mov rax, rbx
mov r11d, 0x104
sub rdx, rbx
nop
movzx ecx, word [rdx + rax]
test cx, cx
je 0x1400045e8
mov word [rax], cx
add rax, 2
sub r11, 1
jne 0x1400045d0
jmp 0x1400045ed
test r11, r11
jne 0x1400045f1
sub rax, 2
mov word [rax], 0
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004690
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rdx, str.HomeDirectory
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004685
lea rdx, str._ProgramFiles_
mov rcx, rbx
call fcn.140005000
test rax, rax
je 0x140004685
lea rdx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x40]
jmp 0x140004693
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400049a0
add rsp, 0x260
pop rbx
ret
Function at 0x1400051f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14000524e
cmp dword [0x140016f10], 2
je 0x140005230
call fcn.1400077c0
mov ecx, 0x12
call fcn.140007580
mov ecx, 0xff
call fcn.140007180
mov eax, 0xff
jmp 0x140005455
mov dword [rax], 0x94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14000527f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x140005455
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x1400052b1
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x1400174e4], r13d
mov dword [0x1400174ec], eax
mov dword [0x1400174f0], esi
mov dword [0x1400174f4], r12d
mov dword [0x1400174e8], edi
cmp word [0x140000000], 0x5a4d
jne 0x140005337
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x140005305
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x14000533d
cmp word [rax + 0x18], 0x20b
je 0x140005315
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x14000533d
cmp dword [rax + 0x84], 0xe
ja 0x140005326
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x14000533d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x50], ebx
jmp 0x14000533d
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov ecx, 1
call fcn.1400078b0
test eax, eax
jne 0x14000536d
cmp dword [0x140016f10], 2
je 0x140005359
call fcn.1400077c0
mov ecx, 0x1c
call fcn.140007580
mov ecx, 0xff
call fcn.140007180
call fcn.140006b80
test eax, eax
jne 0x140005398
cmp dword [0x140016f10], 2
je 0x140005384
call fcn.1400077c0
mov ecx, 0x10
call fcn.140007580
mov ecx, 0xff
call fcn.140007180
call fcn.140009b80
nop
call fcn.140009840
test eax, eax
jns 0x1400053b1
mov ecx, 0x1b
call fcn.140007150
call fcn.140009720
mov qword [0x140019898], rax
call fcn.140009520
mov qword [0x140016f08], rax
call fcn.1400092b0
test eax, eax
jns 0x1400053dc
mov ecx, 8
call fcn.140007150
call fcn.140008f80
test eax, eax
jns 0x1400053ef
mov ecx, 9
call fcn.140007150
mov ecx, 1
call fcn.1400072c0
test eax, eax
je 0x140005404
mov ecx, eax
call fcn.140007150
mov r8, qword [0x140017520]
mov qword [0x140017528], r8
mov rdx, qword [0x140017508]
mov ecx, dword [0x1400174f8]
call fcn.140001b80
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140005435
mov ecx, eax
call fcn.1400074d0
call fcn.1400074f0
jmp 0x140005453
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.140009c00
add rsp, 0x28
jmp 0x1400051f0