joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f3b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rbx, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14001f3e3
mov rdx, qword [r8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001f43f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsi + 0x18], 8
jb 0x14001f418
mov rsi, qword [rsi]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f545
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x80], r14d
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001f459
mov rdx, qword [rbx]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001f545
cmp dword [rsp + 0x30], 1
jne 0x14001f545
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14001f545
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14002cf14
mov rsi, rax
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + 0x80]
add r8, r8
xor edx, edx
mov rcx, rax
call fcn.14002f630
cmp qword [rbx + 0x18], 8
jb 0x14001f4e4
mov rbx, qword [rbx]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14001f538
mov rdx, rsi
mov rcx, rdi
call fcn.140002e90
nop
test rsi, rsi
je 0x14001f560
mov rcx, rsi
call fcn.14002cf0c
jmp 0x14001f560
test rsi, rsi
je 0x14001f545
mov rcx, rsi
call fcn.14002cf0c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x90]
mov rcx, rdi
call fcn.140002df0
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14001fab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14001fabe
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001fad4
test al, 0x10
je 0x14001fad4
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x14001fae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14001faee
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001fb04
test al, 0x10
jne 0x14001fb04
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x14001fc90
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140075238]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
cmp qword [rcx + 0x10], 0
je 0x14001fe03
cmp qword [rcx + 0x18], 8
jb 0x14001fcbd
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001fcd0
test al, 0x10
jne 0x14001fdb0
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001fcdd
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001fdb0
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001fcf9
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001fdb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001fdb0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140002df0
nop
lea rcx, [rsp + 0x20]
call fcn.14001f210
cmp qword [rsp + 0x30], 0
je 0x14001fdc5
lea rcx, [rsp + 0x20]
call fcn.14001fc90
test al, al
je 0x14001fdc5
cmp qword [rbx + 0x18], 8
jb 0x14001fd56
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001fd72
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14001fdc5
mov rax, qword [rsp + 0x38]
cmp rax, 8
jb 0x14001fdb0
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fdab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fe18
call fcn.14002cf0c
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002d580
add rsp, 0x50
pop rbx
ret
mov rax, qword [rsp + 0x38]
cmp rax, 8
jb 0x14001fe03
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fdfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fe18
call fcn.14002cf0c
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002d580
add rsp, 0x50
pop rbx
ret
call fcn.14003350c
int3
Function at 0x140025c30
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140075238]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.14002f630
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140025cba
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140025ca2
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000b3c0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002d580
add rsp, 0x250
pop rbx
ret

Function at 0x140025fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x140075238]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
mov qword [rsp + 0x58], 7
mov rbx, r8
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
mov rsi, r9
mov rbp, rcx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x140026000
lea rcx, [rsp + 0x40]
call fcn.14000b3c0
cmp qword [rsp + 0x58], 8
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
cmovae rdx, qword [rsp + 0x40]
mov r9d, 0x20219
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002609c
mov eax, dword [rsp + 0xc0]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add eax, eax
mov dword [rsp + 0x34], eax
xor r8d, r8d
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14002609c
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x1400260a1
mov edi, 0x80004005
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400260df
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400260da
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400260f7
call fcn.14002cf0c
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002d580
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14003350c
int3
Function at 0x1400273d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov esi, r8d
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x140027607
test r8d, r8d
je 0x140027607
test sil, 3
jne 0x140027607
xor r15d, r15d
lea eax, [r8 - 1]
cmp byte [rax + rcx], 0x3d
mov r11d, r15d
jne 0x14002743a
nop dword [rax]
inc r11d
cmp r11d, 2
ja 0x140027607
mov eax, esi
sub eax, r11d
dec eax
cmp byte [rax + rcx], 0x3d
je 0x140027420
shr esi, 2
mov edi, r15d
mov ebp, r15d
test esi, esi
je 0x140027600
nop dword [rax + rax]
lea edx, [rbp*4]
movzx r9d, byte [rdx + rbx]
lea eax, [r9 - 0x41]
cmp al, 0x19
ja 0x14002746a
sub r9b, 0x41
jmp 0x1400274ad
lea eax, [r9 - 0x61]
cmp al, 0x19
ja 0x140027478
sub r9b, 0x47
jmp 0x1400274ad
lea eax, [r9 - 0x30]
cmp al, 9
ja 0x140027486
add r9b, 4
jmp 0x1400274ad
cmp r9b, 0x2b
jne 0x140027491
mov r9b, 0x3e
jmp 0x1400274ad
cmp r9b, 0x2f
jne 0x14002749c
mov r9b, 0x3f
jmp 0x1400274ad
cmp r9b, 0x3d
mov eax, 0xff
cmove eax, r15d
movzx r9d, al
lea eax, [rdx + 1]
movzx r10d, byte [rax + rbx]
lea eax, [r10 - 0x41]
cmp al, 0x19
ja 0x1400274c3
sub r10b, 0x41
jmp 0x140027506
lea eax, [r10 - 0x61]
cmp al, 0x19
ja 0x1400274d1
sub r10b, 0x47
jmp 0x140027506
lea eax, [r10 - 0x30]
cmp al, 9
ja 0x1400274df
add r10b, 4
jmp 0x140027506
cmp r10b, 0x2b
jne 0x1400274ea
mov r10b, 0x3e
jmp 0x140027506
cmp r10b, 0x2f
jne 0x1400274f5
mov r10b, 0x3f
jmp 0x140027506
cmp r10b, 0x3d
mov eax, 0xff
cmove eax, r15d
movzx r10d, al
lea eax, [rdx + 2]
movzx eax, byte [rax + rbx]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x140027519
sub al, 0x41
jmp 0x14002754f
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x140027525
sub al, 0x47
jmp 0x14002754f
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x140027531
add al, 4
jmp 0x14002754f
cmp al, 0x2b
jne 0x140027539
mov al, 0x3e
jmp 0x14002754f
cmp al, 0x2f
jne 0x140027541
mov al, 0x3f
jmp 0x14002754f
cmp al, 0x3d
mov ecx, 0xff
cmove ecx, r15d
movzx eax, cl
lea ecx, [rdx + 3]
movzx r8d, byte [rcx + rbx]
lea ecx, [r8 - 0x41]
cmp cl, 0x19
ja 0x140027566
sub r8b, 0x41
jmp 0x1400275ab
lea ecx, [r8 - 0x61]
cmp cl, 0x19
ja 0x140027575
sub r8b, 0x47
jmp 0x1400275ab
lea ecx, [r8 - 0x30]
cmp cl, 9
ja 0x140027584
add r8b, 4
jmp 0x1400275ab
cmp r8b, 0x2b
jne 0x14002758f
mov r8b, 0x3e
jmp 0x1400275ab
cmp r8b, 0x2f
jne 0x14002759a
mov r8b, 0x3f
jmp 0x1400275ab
cmp r8b, 0x3d
mov ecx, 0xff
cmove ecx, r15d
movzx r8d, cl
cmp r9b, 0xff
je 0x140027607
cmp r10b, 0xff
je 0x140027607
cmp al, 0xff
je 0x140027607
cmp r8b, 0xff
je 0x140027607
mov ecx, edi
movzx edx, r10b
shr dl, 4
inc edi
shl r9b, 2
inc ebp
or dl, r9b
shl r10b, 4
mov byte [rcx + r14], dl
movzx edx, al
shr dl, 2
or dl, r10b
shl al, 6
mov byte [rdi + r14], dl
or al, r8b
inc edi
mov byte [rdi + r14], al
inc edi
cmp ebp, esi
jb 0x140027450
sub edi, r11d
mov eax, edi
jmp 0x140027609
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140027920
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r14
sub rsp, 8
mov r14d, r8d
mov r11, rdx
mov rbp, rcx
test rcx, rcx
je 0x140027b03
test r8d, r8d
je 0x140027b03
mov qword [rsp + 0x20], rbx
mov eax, 0xaaaaaaab
mul r14d
mov qword [rsp + 0x28], rsi
mov ecx, 0
mov qword [rsp + 0x30], rdi
mov ebx, ecx
mov edi, edx
mov esi, r8d
shr edi, 1
lea eax, [rdi + rdi*2]
sub esi, eax
setne bl
add ebx, edi
shl ebx, 2
test r11, r11
jne 0x140027993
mov eax, ebx
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
add rsp, 8
pop r14
pop rbp
ret
mov qword [rsp + 0x38], r12
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov qword [rsp], r15
mov r15d, ecx
test edi, edi
je 0x140027a3d
nop
lea r9d, [r15 + r15*2]
mov edx, ecx
movzx eax, byte [r9 + rbp]
inc ecx
shr rax, 2
inc r15d
movzx eax, byte [rax + r12]
mov byte [rdx + r11], al
lea eax, [r9 + 1]
movzx r8d, byte [r9 + rbp]
mov r10d, eax
and r8d, 3
movzx eax, byte [rax + rbp]
shr rax, 4
shl r8, 4
or r8, rax
movzx eax, byte [r8 + r12]
mov byte [rcx + r11], al
inc ecx
movzx r8d, byte [r10 + rbp]
lea eax, [r9 + 2]
mov r9d, eax
and r8d, 0xf
movzx eax, byte [rax + rbp]
shr rax, 6
shl r8, 2
or r8, rax
movzx eax, byte [r8 + r12]
mov byte [rcx + r11], al
inc ecx
movzx eax, byte [r9 + rbp]
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx + r11], al
inc ecx
cmp r15d, edi
jb 0x1400279b0
mov r15, qword [rsp]
sub esi, 1
je 0x140027ab9
cmp esi, 1
jne 0x140027af7
mov edx, ecx
lea eax, [r14 - 2]
mov r8d, eax
inc ecx
movzx eax, byte [rax + rbp]
shr rax, 2
movzx eax, byte [rax + r12]
mov byte [rdx + r11], al
lea eax, [r14 - 1]
movzx r8d, byte [r8 + rbp]
mov r9d, eax
and r8d, 3
movzx eax, byte [rax + rbp]
shr rax, 4
shl r8, 4
or r8, rax
movzx eax, byte [r8 + r12]
mov byte [rcx + r11], al
inc ecx
movzx eax, byte [r9 + rbp]
and eax, 0xf
movzx eax, byte [r12 + rax*4]
mov r12, qword [rsp + 0x38]
mov byte [rcx + r11], al
inc ecx
mov eax, ebx
mov byte [rcx + r11], 0x3d
jmp 0x14002797c
mov edx, ecx
lea eax, [r14 - 1]
mov r8d, eax
inc ecx
movzx eax, byte [rax + rbp]
shr rax, 2
movzx eax, byte [rax + r12]
mov byte [rdx + r11], al
movzx eax, byte [r8 + rbp]
and eax, 3
add rax, rax
movzx eax, byte [r12 + rax*8]
mov byte [rcx + r11], al
inc ecx
mov byte [rcx + r11], 0x3d
inc ecx
mov byte [rcx + r11], 0x3d
mov r12, qword [rsp + 0x38]
mov eax, ebx
jmp 0x14002797c
xor eax, eax
add rsp, 8
pop r14
pop rbp
ret
Function at 0x140027e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140075238]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x140077568]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140076e98], eax
jg 0x140027eca
lea rax, [0x140076e78]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d580
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov qword [0x140076e88], 0
mov qword [0x140076e90], 0xf
mov byte [0x140076e78], 0
lea rdx, [rbp - 0x30]
lea rbx, [0x140076e78]
mov rcx, rbx
call fcn.140022190
lea rcx, [0x140052fe0]
call fcn.14002d154
nop
lea rcx, [0x140076e98]
call fcn.14002d294
mov rax, rbx
jmp 0x140027e65
lea rcx, [0x140076e98]
call fcn.14002d2f4
cmp dword [0x140076e98], 0xffffffff
jne 0x140027e5e
mov byte [rbp - 0x30], 0x69
mov byte [rbp - 0x2f], 0x6f
mov byte [rbp - 0x2e], 0x4e
mov byte [rbp - 0x2d], 0x69
mov byte [rbp - 0x2c], 0x2c
mov byte [rbp - 0x2b], 0x11
mov byte [rbp - 0x2a], 0x25
mov byte [rbp - 0x29], 0x4e
mov byte [rbp - 0x28], 0x7d
mov byte [rbp - 0x27], 0x2c
mov byte [rbp - 0x26], 0x11
mov byte [rbp - 0x25], 0x2c
mov byte [rbp - 0x24], 0x54
mov byte [rbp - 0x23], 0x26
mov byte [rbp - 0x22], 0x18
mov byte [rbp - 0x21], 0x68
mov byte [rbp - 0x20], 0x3a
mov byte [rbp - 0x1f], 0x18
mov byte [rbp - 0x1e], 4
mov byte [rbp - 0x1d], 0x3a
mov byte [rbp - 0x1c], 0x25
mov byte [rbp - 0x1b], 0x4e
mov byte [rbp - 0x1a], 0x6f
mov byte [rbp - 0x19], 0x6f
mov byte [rbp - 0x18], 0x12
mov byte [rbp - 0x17], 4
mov byte [rbp - 0x16], 0x3a
mov byte [rbp - 0x15], 0x18
mov byte [rbp - 0x14], 0x7c
mov byte [rbp - 0x13], 4
mov byte [rbp - 0x12], 0x6f
mov byte [rbp - 0x11], 0x25
mov byte [rbp - 0x10], 0
movzx eax, byte [rbp - 0x30]
mov byte [rbp - 0xf], 0
movzx eax, byte [rbp - 0xf]
test al, al
jne 0x140027e7c
mov byte [rbp - 0xf], 1
xor r9d, r9d
movsx ecx, byte [rbp + r9 - 0x30]
sub ecx, 0x6c
imul r8d, ecx, 0x13
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 - 0x30], r8b
inc r9
cmp r9, 0x20
jb 0x140027f82
jmp 0x140027e7c
Function at 0x14002a3c0
Capabilities:
Compare security identifiers

Disassembly:
push rdi
push r15
sub rsp, 0x48
xor r15d, r15d
mov rdi, rcx
mov qword [rsp + 0x60], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rcx, rax
lea edx, [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x14002a5f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x14002a5f3
mov rcx, rdi
mov qword [rsp + 0x38], rsi
call fcn.14002ae10
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002a5e3
mov qword [rsp + 0x68], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14002a5c9
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x30], r14
test rsi, rsi
je 0x14002a5ae
test rbx, rbx
je 0x14002a5ae
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r15 + 1]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14002a4a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002a5ae
mov ecx, dword [rsp + 0x60]
call fcn.14002cf14
mov r9d, dword [rsp + 0x60]
mov r14, rax
lea rax, [rsp + 0x60]
mov r8, r14
mov edx, 1
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002a5a6
mov rbp, qword [r14]
test rbp, rbp
je 0x14002a5a6
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x14002a5a6
xor r9d, r9d
mov dword [rsp + 0x60], r15d
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14002a52c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002a5ae
mov ecx, dword [rsp + 0x60]
call fcn.14002cf14
mov r9d, dword [rsp + 0x60]
mov r15, rax
lea rax, [rsp + 0x60]
mov r8, r15
mov edx, 1
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002a599
mov rbx, qword [r15]
test rbx, rbx
je 0x14002a599
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x14002a599
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, 1
mov rcx, r14
sete bl
call fcn.14002cf0c
mov rcx, r15
call fcn.14002cf0c
test bl, bl
jne 0x14002a5ba
jmp 0x14002a5ae
mov rcx, r14
call fcn.14002cf0c
mov rcx, r15
jmp 0x14002a5a9
mov rcx, r14
call fcn.14002cf0c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [rdi], 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x14002a5e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x48
pop r15
pop rdi
ret
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
add rsp, 0x48
pop r15
pop rdi
ret
Function at 0x14002a980
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x140075238]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ebp, edx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x34], r14d
lea rcx, [rsp + 0x30]
call fcn.14002a3c0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14002f630
cmp byte [0x140076fc0], r14b
jne 0x14002aa24
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
lea rdx, str.Support_GetWinSpecialFoldersFromReg
lea rcx, [rsp + 0x40]
call fcn.140004120
nop
mov edi, 1
mov dword [rsp + 0x34], edi
lea rcx, [rsp + 0x40]
call fcn.140027fe0
test al, al
jne 0x14002aa24
xor sil, sil
jmp 0x14002aa27
mov sil, 1
test dil, 1
je 0x14002aa6f
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002aa6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002aa6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ab00
call fcn.14002cf0c
lea rdx, [rsp + 0x60]
test sil, sil
je 0x14002aa9c
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0xffffffffffffffff
xor r9d, r9d
mov r8d, 0x104
mov ecx, ebp
call fcn.14002a620
jmp 0x14002aaaa
xor r9d, r9d
mov r8d, ebp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140004120
nop
cmp byte [rsp + 0x30], 0
je 0x14002aad5
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14002d580
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14003350c
nop
int3
Function at 0x14002ae10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140075238]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14002b005
cmp dword [rsp + 0x20], 0xffffffff
je 0x14002b005
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
xor edx, edx
lea ecx, [rsi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002afbe
mov dword [rsp + 0x50], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call fcn.14002f630
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
mov rdi, qword [rsp + 0x38]
test eax, eax
je 0x14002af2a
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x7c]
call fcn.14003c448
test eax, eax
jne 0x14002af19
cmp rdi, rsi
je 0x14002aefd
mov eax, dword [rsp + 0x58]
mov dword [rdi], eax
add rdi, 4
mov qword [rsp + 0x38], rdi
jmp 0x14002af19
lea r8, [rsp + 0x58]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14002a230
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14002aed2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x30]
cmp r15, rdi
je 0x14002afc3
mov rbx, r15
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp + 0x24], 0xffffffff
lea rdx, [rsp + 0x24]
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14002afab
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x24], eax
jne 0x14002afab
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x100400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14002afab
lea r8, [rsp + 0x28]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, r14
test eax, eax
jne 0x14002afb6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
cmp rbx, rdi
je 0x14002afc3
jmp 0x14002af50
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002afc3
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
test r15, r15
je 0x14002b000
sub rsi, r15
and rsi, 0xfffffffffffffffc
mov rax, r15
cmp rsi, 0x1000
jb 0x14002aff5
add rsi, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b036
mov rdx, rsi
mov rcx, r15
call fcn.14002cf0c
mov rax, rbx
jmp 0x14002b00a
mov rax, qword [rsp + 0x28]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14002d580
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14003350c
int3