joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c000
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [r9]
xor ebx, ebx
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov dword [rax], ecx
test ecx, ecx
je 0x14000c15e
cmp ecx, 1
jne 0x14000c153
lea edx, [rbx + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov rax, qword [rdi]
mov qword [rax + 8], rcx
mov rax, qword [rdi]
cmp qword [rax + 8], rbx
je 0x14000c153
mov eax, esi
mov rcx, rbp
neg eax
sbb r8d, r8d
and qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
and r8d, 2
add r8d, 2
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx], rdx
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000c153
neg esi
sbb edx, edx
and qword [rsp + 0x20], rbx
and edx, 0xfffffffe
xor r9d, r9d
add edx, 4
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 8], rdx
mov rax, qword [rdi]
mov r8, qword [rax + 8]
mov rdx, qword [r8 + 8]
test rdx, rdx
je 0x14000c153
cmp dword [rdx], 0x66676572
mov rcx, rax
jne 0x14000c135
cmp dword [rdx + 0x1c], ebx
jne 0x14000c135
add rdx, 0x1000
cmp dword [rdx], 0x6e696268
jne 0x14000c135
mov qword [r8 + 0x10], rdx
movsxd rax, dword [rdx + 4]
add rdx, 0x20
add rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 0x18], rdx
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov rdx, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [rdx + 4], ax
jne 0x14000c131
test byte [rdx + 6], 0xc
je 0x14000c131
mov ebx, 1
test ebx, ebx
jne 0x14000c163
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000c163
mov ebx, 1
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c744
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov r9d, dword [rcx]
xor edi, edi
mov r10, r8
mov r11, rdx
mov r14, rcx
test r9d, r9d
je 0x14000c7f1
cmp r9d, 1
jne 0x14000c82b
call fcn.14000c604
test rax, rax
mov rcx, rax
setne dil
test rax, rax
je 0x14000c82b
mov ebx, dword [rax + 8]
mov rdx, qword [rsp + 0x60]
btr ebx, 0x1f
test rdx, rdx
je 0x14000c7a8
mov eax, dword [rax + 0x10]
mov dword [rdx], eax
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14000c82b
mov r9, qword [rsp + 0x68]
test r9, r9
je 0x14000c7ed
xor edi, edi
cmp dword [rsi], ebx
setae dil
jb 0x14000c7ed
cmp dword [rcx + 8], 0
lea rdx, [rcx + 0xc]
jl 0x14000c7e2
mov rax, qword [r14 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, ebx
mov rcx, r9
call fcn.14008ccb0
mov dword [rsi], ebx
jmp 0x14000c82b
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov r9, qword [rsp + 0x60]
mov rdx, r10
mov qword [rsp + 0x28], rax
mov rcx, r11
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
test eax, eax
je 0x14000c82b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret

Function at 0x14000c844
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov rdi, rcx
test r9d, r9d
je 0x14000c8d5
cmp r9d, 1
jne 0x14000c90c
call fcn.14000c604
mov r8, rax
test rax, rax
je 0x14000c90c
mov ecx, dword [rax + 8]
mov edx, ecx
mov r9d, dword [rsp + 0x70]
btr edx, 0x1f
cmp edx, r9d
setae bl
jb 0x14000c8ce
mov eax, dword [rsp + 0x60]
and ecx, 0x80000000
or ecx, r9d
mov dword [r8 + 0x10], eax
mov dword [r8 + 8], ecx
lea rcx, [r8 + 0xc]
jl 0x14000c8bf
mov rax, qword [rdi + 8]
movsxd rcx, dword [rcx]
mov rax, qword [rax + 0x10]
add rax, 4
add rcx, rax
mov r8d, edx
mov rdx, qword [rsp + 0x68]
call fcn.14008ccb0
jmp 0x14000c90c
mov ecx, Ordinal_54
jmp 0x14000c906
mov eax, dword [rsp + 0x70]
xor r8d, r8d
mov r9d, dword [rsp + 0x60]
mov rdx, r10
mov dword [rsp + 0x28], eax
mov rcx, r11
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test eax, eax
je 0x14000c90c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c91c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r10d, dword [rcx]
xor r12d, r12d
mov r14, qword [rsp + 0x80]
mov rsi, r9
mov r11d, r8d
mov rbp, rdx
mov edi, r12d
test r10d, r10d
je 0x14000ca58
cmp r10d, 1
jne 0x14000ca90
cmp dword [rdx + 0x18], r12d
je 0x14000ca90
cmp r11d, dword [rdx + 0x18]
jae 0x14000ca90
cmp dword [rdx + 0x20], 0xffffffff
je 0x14000ca90
mov rax, qword [rcx + 8]
movsxd rcx, dword [rdx + 0x20]
mov r8, qword [rax + 0x10]
mov eax, 0x666c
add rcx, r8
cmp word [rcx + 4], ax
je 0x14000c9ad
mov eax, 0x686c
cmp word [rcx + 4], ax
jne 0x14000ca90
cmp word [rcx + 6], r12w
je 0x14000ca90
movzx eax, word [rcx + 6]
cmp r11d, eax
jae 0x14000ca90
movsxd rdx, dword [rcx + r11*8 + 8]
mov eax, 0x6b6e
add rdx, r8
cmp word [rdx + 4], ax
jne 0x14000ca90
test rsi, rsi
je 0x14000ca90
test r14, r14
je 0x14000ca90
test byte [rdx + 6], 0x20
movzx ebx, word [rdx + 0x4c]
je 0x14000ca2e
cmp dword [r14], ebx
seta dil
jbe 0x14000ca4a
lea rcx, [rdx + 0x50]
mov edx, ebx
call fcn.140010140
mov rbp, rax
test rax, rax
je 0x14000ca4a
lea r8, [rbx + rbx]
mov rdx, rax
mov rcx, rsi
call fcn.14008ccb0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000ca4a
shr ebx, 1
cmp dword [r14], ebx
seta dil
jbe 0x14000ca4a
movzx r8d, word [rbp + 0x4c]
add rdx, 0x50
mov rcx, rsi
call fcn.14008ccb0
test edi, edi
je 0x14000ca53
mov word [rsi + rbx*2], r12w
mov dword [r14], ebx
jmp 0x14000ca90
mov qword [rsp + 0x38], r12
mov r9, r14
mov qword [rsp + 0x30], r12
mov r8, rsi
mov qword [rsp + 0x28], r12
mov edx, r11d
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete dil
test eax, eax
je 0x14000ca90
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14000cab4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r11d, r8d
mov r10, rdx
mov r12, r9
mov edx, dword [rcx]
mov r15, rcx
mov esi, r13d
test edx, edx
je 0x14000cc6d
cmp edx, 1
jne 0x14000ccc2
test r10, r10
jne 0x14000cb02
mov rax, qword [rcx + 8]
mov r10, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [r10 + 4], ax
jne 0x14000ccc2
cmp dword [r10 + 0x28], r13d
je 0x14000ccc2
cmp r11d, dword [r10 + 0x28]
jae 0x14000ccc2
cmp dword [r10 + 0x2c], 0xffffffff
je 0x14000ccc2
mov rax, qword [rcx + 8]
movsxd rcx, dword [r10 + 0x2c]
add rcx, qword [rax + 0x10]
movsxd rbx, dword [rcx + r11*4 + 4]
add rbx, qword [rax + 0x10]
mov eax, 0x6b76
cmp word [rbx + 4], ax
jne 0x14000ccc2
test r12, r12
je 0x14000ccc2
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x14000ccc2
movzx eax, word [rbx + 6]
test ax, ax
je 0x14000cbf6
test byte [rbx + 0x14], 1
movzx ebp, ax
movzx edx, ax
je 0x14000cb92
lea rcx, [rbx + 0x18]
call fcn.140010140
mov rdi, rax
jmp 0x14000cbc0
add rdx, 2
shr ebp, 1
mov ecx, Ordinal_65
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14000ccc2
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.14008ccb0
inc ebp
test rdi, rdi
je 0x14000ccc2
cmp dword [r14], ebp
setae sil
jb 0x14000cbeb
mov r8d, ebp
mov rdx, rdi
add r8, r8
mov rcx, r12
call fcn.14008ccb0
lea eax, [rbp - 1]
mov dword [r14], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000cbf9
mov dword [r14], r13d
test esi, esi
je 0x14000ccc2
mov edi, dword [rbx + 8]
mov rcx, qword [rsp + 0xa0]
btr edi, 0x1f
test rcx, rcx
je 0x14000cc1a
mov eax, dword [rbx + 0x10]
mov dword [rcx], eax
mov r14, qword [rsp + 0xb0]
test r14, r14
je 0x14000ccc2
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14000cc68
cmp dword [r14], edi
mov esi, r13d
setae sil
jb 0x14000cc68
lea rdx, [rbx + 0xc]
cmp dword [rbx + 8], r13d
jl 0x14000cc60
mov rax, qword [r15 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, edi
call fcn.14008ccb0
mov dword [r14], edi
jmp 0x14000ccc2
mov rax, qword [rsp + 0xb0]
mov r8, r12
mov r9, qword [rsp + 0x90]
mov edx, r11d
mov qword [rsp + 0x38], rax
mov rcx, r10
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
sete sil
test eax, eax
je 0x14000ccc2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000f9a8
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbp, rdx
mov rdx, rcx
xor ebx, ebx
mov rcx, rdi
lea r8d, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x14000fa03
lea rax, [rsp + 0x58]
mov r8, rbp
lea r9d, [rbx + 0x24]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000faa0
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, str.ServicesActive
xor ebx, ebx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14000fb06
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14000fafd
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000fd64
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov r15, r8
mov r12, rdx
mov rbx, rcx
lea rdx, str.ServicesActive
xor esi, esi
xor ecx, ecx
mov r14d, r9d
lea r8d, [rsi + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x14000ff0d
lea r8d, [rsi + 0x10]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14000fdda
lea rcx, str.____s_service_already_registered_n
mov rdx, rbx
call fcn.140009ba4
jmp 0x14000fea5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x14000fe91
mov rdx, rbx
lea rcx, str.____s_service_not_present_n
call fcn.140009ba4
and qword [rsp + 0x60], rsi
mov r9d, 0x60010
and qword [rsp + 0x58], rsi
mov r8, r12
and qword [rsp + 0x50], rsi
mov rdx, rbx
and qword [rsp + 0x48], rsi
mov rcx, rbp
and qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x14000fe82
mov rdx, rbx
lea rcx, str.____s_service_successfully_registered_n
call fcn.140009ba4
mov rcx, rdi
call fcn.14000fc00
mov esi, eax
test eax, eax
je 0x14000fe73
lea rcx, str.____s_service_ACL_to_everyone_n
jmp 0x14000fdcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___kull_m_service_addWorldToSD__0x_08x__n
jmp 0x14000fe9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___CreateService__0x_08x__n
jmp 0x14000fe9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___OpenService__0x_08x__n
mov edx, eax
call fcn.140009ba4
test rdi, rdi
je 0x14000ff02
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, eax
test eax, eax
je 0x14000fec7
lea rcx, str.____s_service_started_n
jmp 0x14000fedb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x14000fee5
lea rcx, str.____s_service_already_started_n
mov rdx, rbx
call fcn.140009ba4
jmp 0x14000fef9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_service_install___StartService__0x_08x__n
call fcn.140009ba4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000ff21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_service_install___OpenSCManager_create___0x_08x__n
call fcn.140009ba4
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140010a50
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, r8
and qword [rax - 0x18], rdi
mov rbx, rdx
and qword [rdx], rdi
xor r9d, r9d
and qword [rax - 0x20], rdi
xor edx, edx
and dword [r8], edi
mov rbp, rcx
mov qword [rax - 0x28], r8
lea r8d, [rdi + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x140010ada
mov edx, dword [rsi]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x140010ada
and qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
and qword [rsp + 0x28], rdi
mov r9, rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov edi, eax
test eax, eax
jne 0x140010ada
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140010efc
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
lea rax, [r11 - 0x28]
mov rbp, r8
mov qword [r11 - 0x38], rax
mov r14, rdx
lea r8, [r11 + 0x20]
mov rsi, rcx
xor edi, edi
lea r9d, [rbx + 4]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140010fd1
mov eax, dword [rsp + 0x78]
cmp eax, 1
jne 0x140010f8b
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 1]
lea edx, [rbx + 8]
mov dword [rsp + 0x20], 2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
test eax, eax
jne 0x140010f95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___DuplicateTokenEx__0x_08x__n
call fcn.140009ba4
mov eax, dword [rsp + 0x78]
jmp 0x140010f90
mov qword [rsp + 0x38], rsi
cmp eax, 1
je 0x140010fe5
mov rcx, qword [rsp + 0x38]
mov r8, rbp
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ebx, eax
test eax, eax
jne 0x140010fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___CheckTokenMembership__0x_08x__n
call fcn.140009ba4
test edi, edi
je 0x140010fe5
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010fe5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___GetTokenInformation__0x_08x__n
call fcn.140009ba4
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140011104
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor esi, esi
lea rbp, [r11 - 0x24]
test r9, r9
lea rax, [r11 + 0x20]
mov rbx, rdx
mov rdi, r8
cmovne rbp, r9
mov r14, rcx
and dword [rsp + 0x40], esi
lea r9, [r11 - 0x28]
and dword [r11 + 0x20], esi
mov rdx, rcx
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
mov qword [r11 - 0x38], rbp
mov qword [r11 - 0x40], rax
and qword [r11 - 0x48], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1400111f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400111f5
mov edx, dword [rsp + 0x40]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400111f5
mov edx, dword [rsp + 0x88]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x1400111e9
mov r8, qword [rbx]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rdx, r14
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
test eax, eax
jne 0x1400111f5
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x70]
mov eax, esi
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140014550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
xor edi, edi
movsxd rsi, r8d
xor r15d, r15d
xor r12d, r12d
mov r13, rdx
mov r10, rcx
mov r14, rcx
mov rbx, rsi
lea r11d, [rdi + 1]
lea ebp, [rdi + 3]
cmp r9b, r11b
jne 0x140014593
mov r8d, r11d
jmp 0x1400145d0
movzx eax, r9b
mov edx, ebp
sub edx, eax
mov rcx, rbp
sub rcx, rax
mov r8d, 2
jmp 0x1400145b5
cmp byte [rcx + r10], dil
jne 0x1400145ba
add edx, r8d
add rcx, r8
cmp rcx, rbx
jl 0x1400145a9
cmp edx, esi
movzx eax, r9b
movsxd rbx, edx
setl r12b
and rax, r11
add r10, rax
xor rbx, r11
lea rdx, [r14 + rbx]
lea r9, [0x1400bb520]
cmp r10, rdx
jae 0x140014611
mov ecx, r8d
movzx eax, byte [r10]
test byte [rax + r9], r11b
je 0x1400145f8
mov ecx, r8d
add r10, rcx
cmp r10, rdx
jb 0x1400145e3
cmp r10, rdx
jae 0x140014611
cmp byte [r10], 0x2d
jne 0x140014608
mov r15d, r11d
jmp 0x14001460e
cmp byte [r10], 0x2b
jne 0x140014611
add r10, rcx
mov rsi, r10
jmp 0x140014622
cmp byte [r10], 0x30
jne 0x140014627
mov eax, r8d
add r10, rax
cmp r10, rdx
jb 0x140014616
xor ebx, ebx
mov r14d, r8d
cmp r10, rdx
jae 0x140014675
mov r9, r10
mov al, byte [r9]
sub al, 0x30
cmp al, 9
ja 0x14001465e
movsx rax, byte [r9]
lea rcx, [rdi - 6]
lea rcx, [rdi + rcx*4]
add ebx, r8d
add r9, r14
lea rdi, [rax + rcx*2]
movsxd rcx, ebx
add rcx, r10
cmp rcx, rdx
jb 0x140014634
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jbe 0x140014675
mov edi, r15d
add rdi, rax
jmp 0x14001467d
test r15d, r15d
je 0x14001467d
neg rdi
xor r9d, r9d
mov qword [r13], rdi
test ebx, ebx
jne 0x14001468d
cmp rsi, r10
je 0x1400146c2
test r12d, r12d
jne 0x1400146c2
movsxd rcx, ebx
add rcx, r10
cmp rcx, rdx
jae 0x1400146c5
mov edi, ebx
lea rsi, [0x1400bb520]
movzx eax, byte [rcx]
test byte [rax + rsi], r11b
je 0x1400146c2
add edi, r8d
add rcx, r14
movsxd rax, edi
add rax, r10
cmp rax, rdx
jae 0x1400146c5
jmp 0x1400146a6
mov r9d, r11d
imul eax, r8d, 0x13
cmp ebx, eax
jl 0x140014742
jg 0x140014717
xor eax, eax
lea rbx, str.922337203685477580
xor edx, edx
xor edi, edi
cmp edx, 0x12
jge 0x1400146fe
movsxd rax, edi
add edx, r11d
add edi, r8d
movsx ecx, byte [rax + r10]
movsx eax, byte [rbx]
add rbx, r11
sub ecx, eax
lea eax, [rcx + rcx*4]
add eax, eax
je 0x1400146dc
test eax, eax
jne 0x140014710
lea eax, [r8 + r8*8]
add eax, eax
movsx eax, byte [rax + r10]
sub eax, 0x38
mov r11d, eax
test eax, eax
js 0x140014742
mov ecx, r15d
movabs rdx, 0x7fffffffffffffff
add rcx, rdx
mov qword [r13], rcx
test r11d, r11d
jle 0x140014737
mov eax, 2
jmp 0x140014745
test r15d, r15d
cmovne ebp, r9d
mov eax, ebp
jmp 0x140014745
mov eax, r9d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140017724
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd r10, dword [rcx + 0xc]
mov r9, rcx
movsxd r11, r8d
test r8d, r8d
jle 0x14001777b
mov rsi, qword [rcx]
mov rbx, r10
movsxd rbp, dword [rcx + 8]
xor edi, edi
mov al, byte [rdi + rdx]
lea rcx, [rbx + 1]
xor byte [rbx + rsi], al
lea eax, [r10 + 1]
xor r10d, r10d
cmp rcx, rbp
cmovl r10d, eax
xor ebx, ebx
inc rdi
cmp rcx, rbp
cmovl rbx, rcx
cmp rdi, r11
jl 0x140017752
add dword [r9 + 0x10], r8d
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r9 + 0xc], r10d
ret
Function at 0x1400359a8
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
lea r9, str.sqlite_master
mov dword [rax - 0x10], ebx
mov rdi, rdx
mov qword [rax - 0x18], rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.140037da4
test ebx, ebx
jne 0x1400359fb
mov r9, rdi
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.140037da4
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret