joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d0b3c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d0bba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d0bb1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d0bb1
mov rax, qword [rbp - 8]
jmp 0x2fc4d0bcf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0b84
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001b68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
xor r14d, r14d
test rax, rax
je 0x140001bf6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140001bf6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140001be6
cmp rbx, rcx
jae 0x140001bf6
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140001bd1
cmp rbx, rcx
jae 0x140001bf6
cmp word [rbx], r14w
je 0x140001bf6
mov rax, rbx
jmp 0x140001bf8
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140005bd8
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
nop dword [rax + rax]
lea r9, [rbx + 0x18]
mov rcx, rbx
lea r8, str.Main
mov qword [rbx + 0x90], rax
lea rdx, str.SoftKeyboardMain
call fcn.140005d1c
mov r8d, eax
test eax, eax
js 0x140005d06
lea r9, [rbx + 0x20]
mov rcx, rbx
lea r8, str._auxpad
lea rdx, str.SoftKeyboardAux
call fcn.140005d1c
mov r8d, eax
test eax, eax
js 0x140005d06
lea r9, [rbx + 0x40]
mov rcx, rbx
lea r8, str.osknav
lea rdx, str.SoftKeyboardNav
call fcn.140005d1c
mov r8d, eax
test eax, eax
js 0x140005d06
lea r9, [rbx + 0x48]
mov rcx, rbx
lea r8, str.oskclearui
lea rdx, [0x140020920]
call fcn.140005d1c
mov r8d, eax
test eax, eax
js 0x140005d06
lea r9, [rbx + 0x38]
mov rcx, rbx
lea r8, str.osknumpad
lea rdx, str.SoftKeyboardNumPad
call fcn.140005d1c
mov r8d, eax
test eax, eax
js 0x140005d06
lea rdx, [rbx + 0x28]
mov rcx, rbx
call fcn.140005f6c
mov r8d, eax
test eax, eax
js 0x140005d06
cmp qword [rbx + 0xe8], 0
je 0x140005d06
lea r9, [rbx + 0x30]
mov rcx, rbx
lea r8, str.oskpred
lea rdx, str.SoftKeyboardPred
call fcn.140005d1c
mov r8d, eax
test eax, eax
js 0x140005d06
mov rcx, qword [rbx + 0xe8]
mov rdx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x90]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x128], rdx
mov rbx, qword [rsp + 0x30]
mov eax, r8d
add rsp, 0x20
pop rdi
ret
Function at 0x1400061d4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2e0
mov qword [rax - 0x258], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14002a6d8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x70], 0xf
mov rcx, r8
call qword [sym.imp.DUI70.dll_StrToID]
nop dword [rax + rax]
movzx edx, ax
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.DUI70.dll_public:_class_DirectUI::Element____ptr64___cdecl_DirectUI::Element::FindDescendent_unsigned_short_int____ptr64]
nop dword [rax + rax]
mov r15, rax
xor r12d, r12d
mov edi, r12d
mov word [rsp + 0xc0], r12w
mov r8d, 0x104
lea rdx, [rsp + 0xc0]
lea rcx, str._CommonProgramFiles_Microsoft_SharedInk_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x140006288
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x1400063f6
lea rcx, [rsp + 0xc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140006421
lea rcx, [rsp + 0xc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000642c
lea rdx, str.TabSKB.dll
lea rcx, [rsp + 0x58]
call fcn.140001c1c
mov edi, eax
test eax, eax
js 0x1400063ce
lea rdx, str.TipResX.dll
lea rcx, [rsp + 0x50]
call fcn.140001c1c
mov edi, eax
test eax, eax
js 0x1400063c9
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rdi, rax
xor edx, edx
lea r8d, [rdx + 2]
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rdx, rax
mov qword [rsi + 0xf8], rax
mov rcx, qword [rsi + 0x98]
mov qword [rsp + 0x60], rcx
mov eax, 0x1e
mov word [rsp + 0x68], ax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x90], xmm1
mov ecx, dword [rsp + 0x80]
mov dword [rsp + 0xa0], ecx
mov r9, qword [r14]
mov rax, qword [r9 + 0xd8]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdi
mov r9, r15
mov r8, qword [rsi + 0x58]
mov rdx, qword [rsi + 0x50]
mov rcx, r14
call qword [0x140020080]
mov edi, eax
jmp 0x1400063ce
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
nop
jmp 0x1400063f6
mov eax, edi
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14001c9c0
mov rbx, qword [rsp + 0x328]
add rsp, 0x2e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x8007000e
call fcn.140001b40
nop
mov ecx, 0x8007000e
call fcn.140001b40
int3
Function at 0x140008948
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov rcx, rdi
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongW]
nop dword [rax + rax]
test al, 8
je 0x140008a08
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [rax + rax]
cmp dword [rsp + 0x60], eax
je 0x140008a08
cmp rdi, qword [rbx + 0xd0]
jne 0x1400089bc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
sub eax, dword [rbx + 0xd8]
cmp eax, 0x3e8
jbe 0x140008a08
mov rcx, qword [rbx + 0x80]
xor r9d, r9d
mov dword [rsp + 0x30], 0x13
xor r8d, r8d
and dword [rsp + 0x28], 0
or rdx, 0xffffffffffffffff
and dword [rsp + 0x20], 0
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
nop dword [rax + rax]
mov qword [rbx + 0xd0], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
mov dword [rbx + 0xd8], eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140008a1c
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x14002a6d8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, qword [0x14002b410]
mov rsi, rdx
mov edx, 0x7d3
mov rax, qword [rdi + 0x80]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_KillTimer]
nop dword [rax + rax]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
nop dword [rax + rax]
cmp rbx, rax
je 0x140008ba1
xor ebx, ebx
cmp byte [rdi + 0xdc], bl
jne 0x140008ba1
lea rdx, [rsp + 0x20]
mov byte [rdi + 0xdc], 1
xor ecx, ecx
mov dword [rsp + 0x20], 0x48
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
nop dword [rax + rax]
test eax, eax
je 0x140008b5b
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140008b5b
lea r8d, [rbx + 0x40]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetClassNameW]
nop dword [rax + rax]
test eax, eax
jle 0x140008afa
lea rdx, str.ConsoleWindowClass
mov word [rsp + 0xee], bx
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140008b22
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop dword [rax + rax]
test eax, eax
je 0x140008b22
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
nop dword [rax + rax]
mov rsi, rax
test rsi, rsi
je 0x140008b5b
cmp qword [rdi + 0x90], rsi
je 0x140008b5b
mov rcx, rdi
mov qword [rdi + 0x90], rsi
call fcn.140008bd0
mov rcx, rdi
call fcn.140006060
mov rcx, qword [rdi + 0xe8]
test rcx, rcx
je 0x140008b5b
mov rdx, rsi
call fcn.140010698
cmp byte [rdi + 0xdf], bl
je 0x140008b9b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
nop dword [rax + rax]
test rax, rax
je 0x140008b8f
lea rdx, str.StartMenuTag
mov rcx, rax
call qword [sym.imp.USER32.dll_GetPropW]
nop dword [rax + rax]
test rax, rax
jne 0x140008b9b
mov rcx, qword [rdi + 0xe8]
call fcn.140010770
mov byte [rdi + 0xdc], bl
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14001c9c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000c984
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov esi, r9d
mov ebp, edx
mov r14, rcx
cmp edx, 0x14
jae 0x14000ca9d
and qword [rax - 0x30], 0
and qword [rax - 0x28], 0
and qword [rax - 0x20], 0
and qword [rax - 0x40], 0
mov rdx, 0xffffffff80000001
lea rcx, [rax - 0x30]
mov dword [rax - 0x50], 0x2001f
test r9d, r9d
je 0x14000c9ef
mov dword [rax - 0x58], 1
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionAccessibilityATConfigosk
jmp 0x14000c9fb
and dword [rsp + 0x20], 0
lea r8, [0x140020fb0]
call fcn.14000c204
mov rdi, qword [rsp + 0x48]
test eax, eax
jne 0x14000ca82
lea rcx, [rbp*2]
add rcx, rbp
lea rdx, str.WindowLeft
lea r9d, [rax + 4]
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rdx + rcx*8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000ca65
xor ebx, ebx
test esi, esi
jne 0x14000ca6a
mov r8d, dword [rsp + 0x90]
mov edx, ebp
mov rcx, r14
call fcn.14000c8b8
jmp 0x14000ca6a
mov ebx, 0x80004005
test rdi, rdi
je 0x14000ca87
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
xor edi, edi
jmp 0x14000ca87
mov ebx, 0x80004005
test rdi, rdi
je 0x14000caa2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14000caa2
mov ebx, 0x80004005
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000cb2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 8], 0
lea rax, [rbp - 8]
mov r12, r8
mov r15d, edx
xor r8d, r8d
mov qword [rsp + 0x20], rax
test r9d, r9d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAccessibilityATConfigosk
mov r14d, r9d
mov rdi, rcx
mov r9d, 0x20019
mov rcx, 0xffffffff80000001
jne 0x14000cb82
lea rdx, [0x140020fb0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jne 0x14000cbb3
xor ecx, ecx
cmp qword [rdi], rcx
je 0x14000cbac
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, eax
mov rax, qword [rbp - 8]
mov qword [rdi], rax
test ecx, ecx
jne 0x14000cc6c
and dword [rbp + 0x48], ecx
lea rax, [rbp - 0x10]
mov rcx, qword [rdi]
lea rsi, [r15 + r15*2]
mov qword [rsp + 0x28], rax
lea rbx, str.WindowLeft
mov rdx, qword [rbx + rsi*8]
lea rax, [rbp + 0x48]
lea r9, [rbp - 8]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x10], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000cc4d
cmp dword [rbp - 8], 4
jne 0x14000cc4d
test eax, eax
jne 0x14000cc4d
cmp dword [rbx + rsi*8 + 0xc], 0
mov eax, dword [rbp + 0x48]
je 0x14000cc45
mov ebx, dword [rbx + rsi*8 + 0x10]
cmp ebx, eax
ja 0x14000cc2f
lea rcx, str.WindowLeft
mov ebx, dword [rcx + rsi*8 + 0x14]
cmp eax, ebx
jbe 0x14000cc45
cmp ebx, eax
je 0x14000cc45
mov r9d, r14d
mov r8d, ebx
mov edx, r15d
mov rcx, rdi
call fcn.14000c984
mov eax, ebx
mov dword [rbp + 0x48], ebx
mov dword [r12], eax
xor ebx, ebx
jmp 0x14000cc52
mov ebx, 0x80004005
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000cc71
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rdi], 0
jmp 0x14000cc71
mov ebx, 0x80004005
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000cc94
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [0x14002b430]
lea rax, [rbp + 0x30]
and qword [rbp + 0x30], 0
lea rdx, [0x140020fb0]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000cde2
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000cd00
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
mov qword [rbx], rcx
test eax, eax
jne 0x14000cde2
lea r12, str.WindowLeft
xor edi, edi
mov r14, r12
mov rdx, qword [r14]
lea rax, [rbp + 0x38]
mov rcx, qword [rbx]
lea r9, [rbp + 0x40]
and dword [rbp + 0x30], 0
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000cdbb
cmp dword [rbp + 0x40], 4
jne 0x14000cdbb
test eax, eax
jne 0x14000cdbb
mov r8d, dword [rbp + 0x30]
lea rcx, [rdi + rdi*2]
cmp dword [r12 + rcx*8 + 0xc], eax
je 0x14000cd9d
mov esi, dword [r12 + rcx*8 + 0x10]
cmp esi, r8d
ja 0x14000cd87
mov esi, dword [r12 + rcx*8 + 0x14]
cmp r8d, esi
jbe 0x14000cd9d
cmp esi, r8d
je 0x14000cd9d
xor r9d, r9d
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.14000c984
mov r8d, esi
mov dword [rbp + 0x30], esi
mov r9d, 1
mov edx, edi
mov rcx, rbx
call fcn.14000c984
mov r8d, dword [rbp + 0x30]
mov edx, edi
mov rcx, rbx
call fcn.14000c8b8
inc edi
add r14, 0x18
cmp edi, 0x14
jb 0x14000cd1b
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000cde2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbx], 0
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d0a4
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, qword [0x14002a6d8]
xor rax, rsp
mov qword [rbp + 0x180], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 0x1f8
mov qword [rsp + 0x30], rax
lea r8, str.Stepping
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftOsk
and qword [rsp + 0x20], 0
mov r12, 0xffffffff80000001
mov r9d, 0x10
mov rcx, r12
xor dil, dil
xor sil, sil
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d19a
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOsk
mov rcx, r12
mov dil, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d19a
mov rbx, qword [rsp + 0x48]
lea rdx, str.Stepping
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test rbx, rbx
je 0x14000d19a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [rsp + 0x44]
mov r9d, 8
mov qword [rsp + 0x30], rax
lea r8, str.Setting
lea rax, [rbp - 0x80]
mov rcx, r12
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftOsk
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d23f
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOsk
mov rcx, r12
mov sil, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d23f
mov rbx, qword [rsp + 0x48]
lea rdx, str.Setting
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test rbx, rbx
je 0x14000d23f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test dil, dil
je 0x14000d2c3
cmp dword [rsp + 0x40], 4
jne 0x14000d2c3
cmp dword [rsp + 0x50], 3
jne 0x14000d2c3
test sil, sil
je 0x14000d2c3
cmp dword [rsp + 0x44], 0x1f8
jne 0x14000d2c3
cmp dword [rbp + 0x168], 0
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x58], eax
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x5c], eax
mov eax, dword [rbp + 0x80]
mov dword [rsp + 0x60], eax
mov eax, dword [rbp + 0x16c]
mov dword [rsp + 0x64], eax
mov eax, dword [rbp + 0x84]
mov dword [rsp + 0x68], eax
mov eax, dword [rbp + 0x88]
mov dword [rsp + 0x6c], eax
je 0x14000d2aa
mov dword [rsp + 0x70], 3
jmp 0x14000d2b9
mov eax, dword [rbp - 0x48]
neg eax
sbb ecx, ecx
neg ecx
inc ecx
mov dword [rsp + 0x70], ecx
lea rcx, [rsp + 0x58]
call fcn.14000cf70
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14001c9c0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140010bbc
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14002a6d8]
xor rax, rsp
mov qword [rbp - 8], rax
xor edi, edi
mov word [rbp - 0xc], 0x500
mov esi, 1
mov dword [rbp - 0x10], edi
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [r11 - 0x38], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], edi
mov dl, sil
mov dword [rsp + 0x40], edi
lea r8d, [rsi + 0x11]
mov dword [rsp + 0x38], edi
mov bl, sil
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x140010c94
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x1c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x140010c55
cmp dword [rbp - 0x1c], esi
sete bl
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
test bl, bl
jne 0x140010c94
xor r9d, r9d
mov byte [rbp - 0x20], dil
lea r8, [rbp - 0x20]
xor edx, edx
mov ecx, 0xaa
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
nop dword [rax + rax]
neg eax
movzx ebx, bl
sbb cl, cl
and byte [rbp - 0x20], cl
cmovne ebx, esi
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001c9c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140010cc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
and dword [rsp + 0x58], 0
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
lea r8, str.EnableLUA
lea rax, [r11 + 0x10]
mov dword [rsp + 0x60], 4
mov rbx, rcx
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov r9d, 0x10
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140010d24
cmp dword [rsp + 0x58], eax
jne 0x140010d24
and dword [rbx], eax
add rsp, 0x40
pop rbx
ret

Function at 0x140011564
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [r9]
mov rbx, r8
add eax, eax
mov rdi, r9
mov dword [rsp + 0x40], eax
xor esi, esi
mov dword [r9], esi
lea rax, [r11 + 8]
mov rcx, qword [rcx]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
xor r8d, r8d
mov qword [r11 - 0x18], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400115dc
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, 1
ja 0x1400115d7
mov ecx, dword [rsp + 0x40]
test rbx, rbx
je 0x1400115f0
test ecx, ecx
je 0x1400115ed
test cl, 1
jne 0x1400115d7
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x1400115f0
mov eax, 0xd
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov word [rbx], si
shr ecx, 1
mov dword [rdi], ecx
xor eax, eax
jmp 0x1400115dc
Function at 0x140011954
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x14002a6d8]
xor rax, rsp
mov qword [rsp + 0x490], rax
xor ebx, ebx
mov dword [rsp + 0x44], 0x202
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0x111
lea rdx, [rsp + 0x260]
lea ecx, [rbx + 2]
call qword [sym.imp.Secur32.dll_GetUserNameExW]
nop dword [rax + rax]
test al, al
je 0x1400119c0
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x260]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
lea rbx, [rax + 2]
lea rax, [rsp + 0x44]
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, str.DefaultAccountSAMName
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionOOBE
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
js 0x140011a40
test rbx, rbx
je 0x140011a40
or edx, 0xffffffff
lea r8, [rsp + 0x50]
mov edi, 1
mov r9d, edx
mov rcx, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
je 0x140011a43
xor dil, dil
mov al, dil
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14001c9c0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x4a0
pop rdi
ret

Function at 0x140011f7c
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14002a6d8]
xor rax, rsp
mov qword [rbp - 8], rax
xor esi, esi
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 0x18]
mov dword [rbp - 0x20], esi
mov qword [r11 - 0x38], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], esi
xor r9d, r9d
mov dword [rsp + 0x40], esi
lea edi, [rsi + 1]
mov dword [rsp + 0x38], esi
lea r8d, [rsi + 4]
mov dword [rsp + 0x30], esi
mov dl, dil
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov dword [rbp - 0x10], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
neg eax
sbb rdx, rdx
and rdx, qword [rbp - 0x18]
mov qword [rbp - 0x18], rdx
je 0x14001202b
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x18]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
test ebx, ebx
je 0x14001202b
cmp dword [rbp - 0x20], esi
jne 0x14001202d
mov edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001c9c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret