joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010400
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x50
mov rsi, rcx
lea rbx, [rcx + 0x48]
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x1400105a8
mov rax, qword [rax]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rdi
call qword [rax + 0x18]
xor ebp, ebp
mov rdi, 0xffffffffffffffff
add rax, 0x18
mov qword [rsp + 0x60], rax
test rbx, rbx
je 0x14001046f
cmp rbx, 0x10000
jae 0x140010461
movzx edx, bx
lea rcx, [rsp + 0x60]
call fcn.14000d4c0
jmp 0x140010481
mov rax, rdi
inc rax
cmp word [rbx + rax*2], bp
jne 0x140010464
jmp 0x140010471
mov eax, ebp
mov r8d, eax
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.14000fd40
lea rcx, [rsp + 0x60]
call fcn.14001d1f0
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400104a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.140010040
test eax, eax
jne 0x1400104c8
mov ebx, 0x80004005
jmp 0x140010591
mov r9d, 0x20006
mov qword [rsp + 0x20], rbp
lea r8, str.AppID
mov dword [rsp + 0x28], ebp
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x20]
call fcn.14000da90
test eax, eax
je 0x140010511
mov ecx, eax
call fcn.14000c270
mov rcx, qword [rsp + 0x20]
mov ebx, eax
test rcx, rcx
je 0x140010591
jmp 0x14001058b
mov rdi, qword [rsp + 0x20]
lea r8, str.2CA75AD3_A844_4DF9_999D_CB82069C55C3
mov rdx, rdi
mov qword [rsp + 0x38], rbp
mov r9d, 0x20006
mov dword [rsp + 0x40], ebp
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x48], rbp
call fcn.14000da90
test eax, eax
je 0x140010557
mov ecx, eax
call fcn.14000c270
mov rcx, qword [rsp + 0x38]
mov ebx, eax
test rcx, rcx
je 0x140010583
jmp 0x14001057d
mov rsi, qword [rsp + 0x38]
lea rdx, str.LocalService
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
call fcn.1400105c0
mov ebx, eax
test rsi, rsi
je 0x140010583
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x140010591
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000c310
int3
Function at 0x140011e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140011e95
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140011e95
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140011e85
nop
cmp rbx, rcx
jae 0x140011e95
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140011e70
cmp rbx, rcx
jae 0x140011e95
cmp word [rbx], 0
je 0x140011e95
mov rax, rbx
jmp 0x140011e97
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140017720
Capabilities:
Get session information
Get session user name

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rbx, rdx
mov r13, rcx
xor esi, esi
mov qword [r11 + 0x20], rsi
lea rax, [r11 + 0x18]
mov qword [r11 - 0x58], rax
lea r9, [r11 + 0x20]
mov edx, 0xffffffff
xor ecx, ecx
lea r8d, [rsi + 5]
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x140017782
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdi, 0xffffffffffffffff
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x1400177c1
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], si
jne 0x1400177a0
mov r8d, eax
mov rcx, rbx
call fcn.14000fd40
mov rcx, qword [rsp + 0x98]
call sub.WTSAPI32.dll_WTSFreeMemory
mov qword [rsp + 0x98], rsi
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14001792e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000fd40
nop
lea rsi, [0x1400f4280]
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x140017803
mov r14, rsi
mov rbx, qword [rsp + 0x30]
sub r14, rbx
sar r14, 1
mov r15d, dword [rbx - 0x10]
test eax, eax
js 0x140017939
movsxd rdx, eax
mov rcx, rsi
call fcn.1400b7e14
mov r12, rax
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r15d
jl 0x140017944
lea ebp, [r15 + rax]
test ebp, ebp
js 0x140017918
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x140017873
mov edx, ebp
lea rcx, [rsp + 0x30]
call fcn.14000e630
mov rbx, qword [rsp + 0x30]
cmp r14, r15
ja 0x14001787c
lea rsi, [rbx + r14*2]
movsxd rdx, r12d
add rdx, rdx
lea rcx, [rbx + r15*2]
mov r9, rdx
mov r8, rsi
call fcn.140018b60
cmp ebp, dword [rbx - 0xc]
jg 0x140017923
mov dword [rbx - 0x10], ebp
movsxd rax, ebp
xor ecx, ecx
mov word [rbx + rax*2], cx
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
mov edx, 0xffffffff
lea r8d, [rcx + 7]
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x1400178d2
xor sil, sil
jmp 0x1400178f7
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x1400178f4
mov rcx, r13
call fcn.14000ac00
mov rcx, qword [rsp + 0x98]
call sub.WTSAPI32.dll_WTSFreeMemory
mov sil, 1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14001790f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, sil
jmp 0x14001776a
mov ecx, 0x80070057
call fcn.14000c310
int3
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80070057
call fcn.14000c310
int3
mov ecx, 0x80070057
call fcn.14000c310
int3
Function at 0x14001b100
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov edi, edx
mov rbx, rcx
lea rax, vtable.PulseService::Core::Notifiers::CLogonNotifier.0
mov qword [rcx], rax
call fcn.14001b0b0
nop
mov dword [rsp + 0x48], 0
cmp qword [rbx + 8], 0
je 0x14001b164
lea r8, [rsp + 0x48]
mov edx, 0x80000000
xor ecx, ecx
call sub.WTSAPI32.dll_WTSWaitSystemEvent
nop
test eax, eax
jne 0x14001b164
mov rcx, qword [rbx + 8]
call fcn.1400a65b0
nop
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
nop
mov rcx, rbx
call fcn.14001a6b0
nop
test dil, 1
je 0x14001b181
mov edx, 0x18
mov rcx, rbx
call fcn.1400a7308
nop
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001b190
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x14001b1b8
mov qword [rdi], 0
mov rax, rdi
add rsp, 0x20
pop rdi
ret
cmp qword [rsp + 0x40], 0
jle 0x14001b1a8
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14001b1ec
inc ebx
cmp ebx, 3
ja 0x14001b222
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001b1d6
mov rbx, qword [rsp + 0x30]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x38]
xorps xmm0, xmm0
mulsd xmm1, qword [0x1400f5c18]
cvtsi2sd xmm0, qword [rsp + 0x40]
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov qword [rdi], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14001b240
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14001b0b0
cmp qword [rbx + 8], 0
mov dword [rsp + 0x30], 0
je 0x14001b286
lea r8, [rsp + 0x30]
mov edx, 0x80000000
xor ecx, ecx
call sub.WTSAPI32.dll_WTSWaitSystemEvent
test eax, eax
jne 0x14001b286
mov rcx, qword [rbx + 8]
call fcn.1400a65b0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x20
pop rbx
ret
Function at 0x14001b800
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov r15, rdx
mov rdi, rcx
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14001b97d
mov rax, qword [rax]
call qword [rax + 0x18]
mov rbp, rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0xc0]
mov rcx, qword [r15]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r14d, eax
test eax, eax
je 0x14001b936
mov ecx, r14d
call fcn.1400a7a1c
mov rsi, rax
mov r9, rax
mov r8d, r14d
xor edx, edx
mov rcx, qword [r15]
call sub.VERSION.dll_GetFileVersionInfoW
mov rcx, rsi
test eax, eax
je 0x14001b8a6
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0x38]
lea rdx, [0x1400f4280]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x14001b8d9
mov rcx, rsi
call fcn.1400a7308
mov rcx, rbp
call fcn.14000c440
add rax, 0x18
mov qword [rdi], rax
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001b963
mov rcx, qword [rdx]
jmp 0x14001b95d
mov rax, qword [rsp + 0x38]
movups xmm2, xmmword [rax]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rdx, xmm0
shr rdx, 0x20
movzx ecx, dx
shr edx, 0x10
pextrw eax, xmm2, 4
movzx r9d, ax
psrldq xmm2, 8
movd r8d, xmm2
shr r8d, 0x10
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._d._d._d._d
lea rcx, [rsp + 0x30]
call fcn.14000c9f0
mov rcx, rsi
call fcn.1400a7308
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx - 0x18]
call fcn.14000c440
add rax, 0x18
mov qword [rdi], rax
mov eax, 0xffffffff
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14001b963
mov rcx, qword [rbx - 0x18]
lea rdx, [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000c310
int3
Function at 0x14001b990
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, r8
mov rsi, rcx
test edx, edx
jne 0x14001ba79
cmp qword [r8 + 0x18], 8
mov rcx, rbx
jb 0x14001b9b5
mov rcx, qword [r8]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp qword [rbx + 0x18], 8
jb 0x14001b9cb
mov rbx, qword [rbx]
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x14001ba8d
mov rax, qword [rax]
mov qword [rsp + 0x30], rdi
call qword [rax + 0x18]
add rax, 0x18
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x48], rax
test rbx, rbx
je 0x14001ba2c
cmp rbx, 0x10000
jae 0x14001ba14
movzx edx, bx
lea rcx, [rsp + 0x48]
call fcn.14000d4c0
jmp 0x14001ba3e
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001ba20
jmp 0x14001ba2e
xor eax, eax
mov r8d, eax
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.14000fd40
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
mov rdi, qword [rsp + 0x30]
jg 0x14001ba82
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
call qword [rax]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000c310
int3
Function at 0x14001f330
Capabilities:
Check os version

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x14014c228]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebx, 5
mov rbp, r9
mov r15, r8
mov dword [rcx], ebx
mov rdi, rdx
mov r14, rcx
xor r12d, r12d
lea esi, [rbx - 4]
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x28]
mov r8d, VarUI4FromDisp
call fcn.1400aeef0
movzx r8d, sil
mov dword [rsp + 0x20], 0x11c
mov edx, 2
mov dword [rsp + 0x24], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 2
lea rcx, [rsp + 0x20]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14001f417
mov dword [rdi], r12d
mov ebx, r12d
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x11c
call fcn.1400aeef0
movzx r8d, sil
mov dword [rsp + 0x140], 0x11c
mov edx, esi
mov dword [rsp + 0x148], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, esi
lea rcx, [rsp + 0x140]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x14001f44d
mov ebx, dword [rdi]
inc ebx
mov dword [rdi], ebx
cmp ebx, 5
jb 0x14001f3c0
mov eax, dword [r14]
lea ebx, [rax + 1]
mov dword [r14], ebx
cmp ebx, 0x14
jb 0x14001f370
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a79f0
add rsp, 0x270
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x11c
call fcn.1400aeef0
movzx r8d, sil
mov dword [rsp + 0x140], 0x11c
mov edx, 0x80
mov byte [rsp + 0x25a], sil
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 0x80
lea rcx, [rsp + 0x140]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x14001f510
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x11c
call fcn.1400aeef0
movzx r8d, sil
mov dword [rsp + 0x20], 0x11c
mov edx, 0x80
mov byte [rsp + 0x13a], 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 0x80
lea rcx, [rsp + 0x20]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14001f502
mov esi, 3
mov dword [r15], esi
call fcn.14001f1f0
mov word [rbp], ax
mov al, 1
jmp 0x14001f42b
mov cl, 2
call fcn.14001f170
neg eax
sbb esi, esi
and esi, 2
mov dword [r15], esi
call fcn.14001f1f0
mov word [rbp], ax
mov al, 1
jmp 0x14001f42b
Function at 0x140022250
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x2e0], rbx
mov rax, qword [0x14014c228]
xor rax, rsp
mov qword [rsp + 0x280], rax
movzx ebp, r8b
mov r15, rdx
mov r12, rcx
xor edx, edx
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x30], rax
xor esi, esi
cmp rax, 0xffffffffffffffff
jne 0x1400222b4
mov ebx, esi
xor dil, dil
jmp 0x140022399
mov dword [rsp + 0x40], 0x238
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x1400222e4
test bpl, bpl
je 0x1400222e4
xor dil, dil
jmp 0x140022399
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140022396
movabs r13, 0xaaaaaaaaaaaaaa9
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x6c]
mov rcx, qword [r12]
call fcn.1400b8094
test eax, eax
jne 0x140022381
test bpl, bpl
je 0x140022348
mov dword [rsp + 0x24], esi
lea rdx, [rsp + 0x24]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x140022381
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x24], eax
jne 0x140022381
mov rdi, qword [r15]
mov r14, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.1400210b0
mov rdx, qword [r15 + 8]
mov rcx, r13
sub rcx, rdx
cmp rcx, 1
jb 0x1400223d6
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rdi + 8], rax
mov qword [r14], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140022310
mov dil, 1
test rbx, rbx
je 0x1400223a7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400a79f0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.14008a750
int3
Function at 0x140027330
Capabilities:
Get token privileges

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400273bc
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x1400273bc
mov edx, eax
lea r8, [rbx + 0x10]
lea rcx, [rbx + 0x10]
call fcn.1400270f0
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x50]
mov r8, qword [rbx + 0x10]
mov edx, 3
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
setne al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400456b0
Capabilities:
Modify service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov r14, rcx
test rcx, rcx
je 0x1400456d4
mov byte [rcx], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rsp + 0xe8], rax
test rax, rax
jne 0x1400456fc
xor bpl, bpl
jmp 0x1400458b4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x14004571a
xor bpl, bpl
jmp 0x1400458a5
mov r8d, 3
lea rdx, str.Winmgmt
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140045893
xor r15d, r15d
mov dword [rsp + 0xe0], r15d
lea r9, [rsp + 0xe0]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140045855
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140045893
mov ebp, dword [rsp + 0xe0]
test ebp, ebp
je 0x140045893
mov byte [rsp + 0xd0], r15b
mov edx, ebp
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0xd0]
lea rcx, [rsp + 0x78]
call fcn.14001e300
lea r9, [rsp + 0xe0]
mov r8d, ebp
mov rbp, qword [rsp + 0x78]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x14004585a
cmp dword [rbp + 4], 4
jne 0x14004581d
test r14, r14
je 0x1400457df
mov byte [r14], 1
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov edx, 0xffffffff
mov r9d, edx
mov r8d, 3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x14004585a
mov rdx, qword [rsp + 0x88]
sub rdx, rbp
mov rax, rbp
cmp rdx, 0x1000
jb 0x14004584d
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400458dc
mov rcx, rbp
call fcn.1400a7308
mov bpl, 1
jmp 0x140045896
test rbp, rbp
je 0x140045893
mov rdx, qword [rsp + 0x88]
sub rdx, rbp
mov rax, rbp
cmp rdx, 0x1000
jb 0x14004588b
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400458d6
mov rcx, rbp
call fcn.1400a7308
xor bpl, bpl
test rdi, rdi
je 0x1400458a5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rsi, rsi
je 0x1400458b4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
nop
test rbx, rbx
je 0x1400458c2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bpl
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400b7964
nop
call fcn.1400b7964
int3
Function at 0x140048b60
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rax, vtable.SystemInfo::ComputerID::CUIDGenerator.0
mov qword [rcx], rax
mov rcx, qword [rcx + 8]
mov edi, 0xffffffff
test rcx, rcx
je 0x140048bee
mov edx, dword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
cmp eax, 0x102
jne 0x140048be3
lea rdx, str.UID:_timeout
lea rcx, [rsp + 0x40]
call fcn.140043f20
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140048bd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor edx, edx
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
nop
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rbx, qword [rsi + 0x28]
test rbx, rbx
je 0x140048c22
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140048c22
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
nop
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140048c22
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi + 0x10]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140048c3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140048de0
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov ebp, edx
mov rbx, rcx
lea rax, vtable.SystemInfo::ComputerID::CUIDGenerator.0
mov qword [rcx], rax
mov rcx, qword [rcx + 8]
mov esi, 0xffffffff
test rcx, rcx
je 0x140048e75
mov edx, dword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
cmp eax, 0x102
jne 0x140048e6a
lea rdx, str.UID:_timeout
lea rcx, [rsp + 0x40]
call fcn.140043f20
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140048e5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
nop
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdi, qword [rbx + 0x28]
test rdi, rdi
je 0x140048ea9
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140048ea9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
nop
mov eax, esi
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140048ea9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbx + 0x10]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140048ec5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
test bpl, 1
je 0x140048ed9
mov edx, 0x30
mov rcx, rbx
call fcn.1400a7308
nop
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret