joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100066c10
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [0x100167cb0], 0
mov ebx, r9d
je 0x100066c3f
lea r8, [0x100002938]
lea rcx, [0x100002a18]
mov edx, 0xe44
call fcn.10009a050
or eax, 0xffffffff
jmp 0x100066c76
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x20]
lea rcx, [0x100166760]
mov rdx, rax
call fcn.100066f74
cmp al, 1
jne 0x100066c72
lea rcx, [0x100166760]
mov edx, ebx
call fcn.100066d50
jmp 0x100066c76
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
Function at 0x100066d50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebp, ebp
mov esi, edx
mov edi, 0x20019
lea r8, [0x100002b28]
lea rcx, [rsp + 0x58]
mov rdx, 0xffffffff80000000
mov r9d, edi
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
call fcn.10001993c
mov ebx, eax
cmp eax, ebp
je 0x100066dcf
mov rcx, qword [rsp + 0x58]
mov dword [0x1001669dc], eax
cmp rcx, rbp
je 0x100066dc8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x100066f42
mov rbx, qword [rsp + 0x58]
lea r8, [0x1000073a0]
lea rcx, [rsp + 0x38]
mov r9d, edi
mov rdx, rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
call fcn.10001993c
mov edi, eax
cmp eax, ebp
je 0x100066e2b
mov rcx, qword [rsp + 0x38]
mov dword [0x1001669dc], eax
cmp rcx, rbp
je 0x100066e16
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rbx, rbp
je 0x100066e24
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x100066f42
mov rdi, qword [rsp + 0x38]
cmp rdi, rbp
jne 0x100066e4d
lea r8, [0x100002a48]
lea rcx, [0x100002a18]
mov edx, 0x15f0
call fcn.10009a050
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, [0x100007548]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x100066eb9
cmp dword [rsp + 0x34], 1
je 0x100066e9a
cmp dword [rsp + 0x34], 2
je 0x100066e9a
mov eax, 0xd
jmp 0x100066eb9
mov eax, dword [rsp + 0x30]
cmp eax, ebp
je 0x100066eb2
test al, 1
jne 0x100066e93
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], bp
je 0x100066eb7
jmp 0x100066e93
mov word [rsp + 0x70], bp
mov eax, ebp
mov dword [0x1001669ec], ebp
cmp eax, ebp
jne 0x100066f0e
lea rax, [0x1001667c8]
lea rcx, [rsp + 0x38]
mov dword [0x1001669ec], 1
mov qword [rsp + 0x38], rax
lea rax, [0x100067618]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
cmp eax, ebp
jne 0x100066f06
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100066f1c
mov esi, dword [0x1001669dc]
jmp 0x100066f24
lea rcx, [0x100166760]
mov edx, esi
call fcn.1000666dc
mov dword [0x1001669dc], eax
mov esi, eax
cmp rdi, rbp
je 0x100066f32
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rbx, rbp
je 0x100066f40
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1000671d4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x100165e00]
mov rax, qword [0x100165e08]
mov rbp, rcx
mov ebx, 1
jmp 0x10006727a
test ebx, ebx
js 0x1000673b9
mov rsi, qword [rdi]
test rsi, rsi
je 0x100067276
mov r9, qword [rsi + 0x10]
and qword [rsp + 0x40], 0
test r9, r9
jne 0x100067223
xor ebx, ebx
jmp 0x100067276
mov rcx, qword [rsi + 0x18]
lea r8, [rsp + 0x40]
lea rdx, [0x100007c60]
call r9
mov ebx, eax
test eax, eax
js 0x10006725f
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsi]
mov r9d, 5
lea rax, [rsi + 0x28]
lea r8d, [r9 - 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x10006726f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x100165e08]
add rdi, 8
cmp rdi, rax
jb 0x100067200
test ebx, ebx
js 0x1000673b9
lea rsi, [0x1000076f8]
jne 0x10006739d
cmp byte [rbp + 0x60], 0
je 0x10006733b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x50], rax
test rax, rax
je 0x100067334
lea rax, [rsp + 0x40]
lea r8, [0x100067afc]
mov r9, rbp
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1000672ec
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x100067334
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test eax, eax
jns 0x100067329
lea rcx, [0x100002a18]
mov r8, rsi
mov edx, 0xdbf
call fcn.10009a050
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [rbp + 0x58]
mov rcx, rdi
add edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10006735b
mov ebx, 0x80004005
jmp 0x10006735f
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test eax, eax
jns 0x1000673b9
lea rcx, [0x100002a18]
mov r8, rsi
mov edx, 0xdca
call fcn.10009a050
test ebx, ebx
jns 0x1000673b9
mov rdi, qword [0x100165e00]
mov rcx, qword [0x100165e08]
xor eax, eax
jmp 0x100067396
test eax, eax
jne 0x1000673a1
mov rdx, qword [rdi]
test rdx, rdx
je 0x100067392
cmp dword [rdx + 0x28], eax
je 0x100067392
mov ecx, dword [rdx + 0x28]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rcx, qword [0x100165e08]
add rdi, 8
cmp rdi, rcx
jb 0x100067371
jmp 0x1000673a1
mov byte [rbp + 0x60], 0
test ebx, ebx
jns 0x1000673b9
lea rcx, [0x100002a18]
mov r8, rsi
mov edx, 0xdea
call fcn.10009a050
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1000673d8
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov sil, dl
xor ecx, ecx
mov r8d, 0xf003f
xor edx, edx
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x100067445
lea r8d, [rbx + 1]
lea rdx, [0x1001667c8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x10006742e
mov rcx, rax
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x100067445
mov eax, 0x80004005
jmp 0x1000675fc
mov rcx, qword [0x100167cc8]
and qword [rsp + 0x68], 0
and qword [rsp + 0x70], 0
mov edx, 0x67
lea rax, [0x100007b08]
lea rbx, [0x1000073a0]
lea r8d, [rdx - 0x66]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
call fcn.10001bbec
test eax, eax
js 0x1000675fc
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea r8, [0x100002b28]
lea rcx, [rsp + 0x58]
mov r9d, 0x20006
mov rdx, 0xffffffff80000000
call fcn.10001993c
test eax, eax
je 0x1000674df
mov ecx, eax
call fcn.100019764
mov rcx, qword [rsp + 0x58]
mov ebx, eax
test rcx, rcx
je 0x1000674d8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000675fc
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
mov r8, rbx
mov rbx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov rdx, rbx
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call fcn.100019880
test eax, eax
je 0x100067554
mov ecx, eax
call fcn.100019764
mov rcx, qword [rsp + 0x40]
mov edi, eax
test rcx, rcx
je 0x10006753f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10006754d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000675fc
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x100067576
lea r8, [0x100002a48]
lea rcx, [0x100002a18]
mov edx, 0x150f
call fcn.10009a050
lea rdx, [0x100007548]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test sil, sil
je 0x1000675de
lea r8, [0x1001667c8]
lea rdx, [0x100007548]
lea rcx, [rsp + 0x40]
mov r9d, 1
call fcn.1000199f8
lea rcx, [0x100166760]
call fcn.10006786c
test eax, eax
jne 0x1000675de
test rdi, rdi
je 0x1000675c7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10006743b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10006743b
test rdi, rdi
je 0x1000675ec
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x1000675fa
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1000676ec
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
lea rcx, [0x100166760]
call fcn.100067b6c
test eax, eax
jne 0x100067715
mov eax, 0x80004005
jmp 0x100067855
and qword [rsp + 0x20], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x30], 0
mov ebx, 0x20006
lea r8, [0x100002b28]
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov rdx, 0xffffffff80000000
call fcn.10001993c
test eax, eax
je 0x10006776b
mov ecx, eax
call fcn.100019764
mov rcx, qword [rsp + 0x20]
mov ebx, eax
test rcx, rcx
je 0x100067764
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x100067855
and qword [rsp + 0x38], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
mov r9d, ebx
mov rbx, qword [rsp + 0x20]
lea rsi, [0x1000073a0]
lea rcx, [rsp + 0x38]
mov rdx, rbx
mov r8, rsi
call fcn.10001993c
test eax, eax
je 0x1000677ce
mov ecx, eax
call fcn.100019764
mov rcx, qword [rsp + 0x38]
mov edi, eax
test rcx, rcx
je 0x1000677b9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x1000677c7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x100067855
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x1000677f0
lea r8, [0x100002a48]
lea rcx, [0x100002a18]
mov edx, 0x150f
call fcn.10009a050
lea rdx, [0x100007548]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [0x100167cc8]
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
xor r8d, r8d
lea r11, [0x100007b08]
lea r9, [rsp + 0x38]
lea edx, [r8 + 0x67]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r11
call fcn.10001bbec
mov esi, eax
test rdi, rdi
je 0x100067845
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x100067853
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x10006786c
Capabilities:
Create service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xa90
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0xa80], rax
xor esi, esi
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea ebp, [rsi + 1]
lea r12, [0x1001667c8]
mov rbx, rax
cmp rax, rsi
je 0x1000678f3
mov r8d, ebp
mov rdx, r12
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp rax, rsi
je 0x1000678df
mov rcx, rax
mov edi, ebp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, esi
je 0x1000678f3
mov eax, ebp
jmp 0x1000679d3
mov ebx, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x1000679d1
cmp eax, ebx
je 0x1000679d1
lea ecx, [rax + 1]
mov edi, 0x22
add eax, 2
mov word [rsp + 0x70], di
mov word [rsp + rcx*2 + 0x70], di
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov word [rsp + rax*2 + 0x70], si
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
cmp rax, rsi
jne 0x100067a01
mov ebx, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
mov r8d, ebx
call fcn.1000680d4
cmp eax, esi
jne 0x1000679bb
lea r8, [0x1000075b0]
lea rcx, [rsp + 0x280]
mov rdx, rbx
call sub.msvcrt.dll_wcscpy_s
cmp eax, esi
je 0x1000679bb
cmp eax, 0xc
je 0x1000679b0
cmp eax, 0x16
je 0x1000679a5
cmp eax, edi
je 0x1000679a5
cmp eax, 0x50
je 0x1000679bb
mov ecx, 0x80004005
call fcn.1000196c8
int3
mov ecx, 0x80070057
call fcn.1000196c8
int3
mov ecx, 0x8007000e
call fcn.1000196c8
int3
lea rdx, [rsp + 0x280]
xor r9d, r9d
mov r8, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
lea rax, [0x1000075f0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
mov r9d, 0xf01ff
mov r8, r12
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebp
mov rdx, r12
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp rax, rsi
jne 0x100067adf
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 0x400
lea rdx, [rsp + 0x280]
mov r8d, ebx
mov ecx, 0xd80b
call fcn.1000680d4
cmp eax, esi
jne 0x1000679bb
lea r8, [0x100007600]
lea rcx, [rsp + 0x280]
mov rdx, rbx
call sub.msvcrt.dll_wcscpy_s
cmp eax, esi
je 0x1000679bb
cmp eax, 0xc
je 0x100067ad4
cmp eax, 0x16
je 0x100067ac9
cmp eax, edi
je 0x100067ac9
cmp eax, 0x50
je 0x1000679bb
mov ecx, 0x80004005
call fcn.1000196c8
int3
mov ecx, 0x80070057
call fcn.1000196c8
int3
mov ecx, 0x8007000e
call fcn.1000196c8
int3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000678ec
Function at 0x100069238
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rdx
mov rbx, rcx
lea rbp, [rcx + 0x50]
mov dword [rbp], 7
add rcx, 0x58
call fcn.100069168
lea rcx, [rbx + 0x60]
call fcn.100069168
lea rcx, [rbx + 0x68]
call fcn.100069168
lea rcx, [rbx + 0x70]
call fcn.100069168
mov byte [rbx + 0x4c], 0
test rsi, rsi
jne 0x1000692c9
lea r8, [0x100007970]
mov edx, 0x9c
lea rcx, [0x100007938]
call fcn.10009a050
xor al, al
jmp 0x100069466
and qword [rsp + 0x50], 0
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.100068d28
mov rdi, qword [rsp + 0x50]
mov dword [rsp + 0x44], 0x44
mov dword [rsp + 0x40], 0x80
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xe0]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100069398
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10006941f
cmp dword [rsp + 0x44], 0x44
jbe 0x100069344
mov ecx, 0x80004005
call fcn.1000196c8
int3
cmp dword [rsp + 0x40], 0x80
jbe 0x100069364
mov edx, dword [rsp + 0x40]
add rdx, rdx
lea rcx, [rsp + 0x50]
call fcn.100068d90
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xe0]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10006941f
lea rcx, [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp eax, 0x44
jb 0x1000693c3
lea r8, [0x100007980]
mov edx, 0xc4
lea rcx, [0x100007938]
call fcn.10009a050
mov byte [rbx + 0x4c], 1
lea rdx, [rbx + 8]
lea r8, [rsp + 0xe0]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x10006941f
mov rdx, rdi
lea rcx, [rbx + 0x60]
call fcn.100069030
mov rdx, rsi
lea rcx, [rbx + 0x58]
call fcn.100069030
xor edx, edx
lea rcx, [rbx + 0x70]
call fcn.100069030
nop
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x50], rcx
je 0x10006941b
lea rcx, [rsp + 0x50]
call fcn.10001c4a8
mov al, 1
jmp 0x100069466
mov dword [rbp], 7
lea rcx, [rbx + 0x58]
call fcn.100069168
lea rcx, [rbx + 0x60]
call fcn.100069168
lea rcx, [rbx + 0x68]
call fcn.100069168
lea rcx, [rbx + 0x70]
call fcn.100069168
mov byte [rbx + 0x4c], 0
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x100069464
lea rcx, [rsp + 0x50]
call fcn.10001c4a8
xor al, al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100087dbc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov esi, r8d
mov r12, rdx
mov rbp, rcx
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
lea r15, [0x100003b28]
cmp rcx, rdi
je 0x100087e1b
test byte [rcx + 0x1c], 1
je 0x100087e1b
cmp byte [rcx + 0x19], 4
jb 0x100087e1b
mov rcx, qword [rcx + 0x10]
mov edx, 0x25
mov r8, r15
call fcn.10001c854
mov rcx, qword [0x1001653b8]
xor ebx, ebx
mov dword [rsp + 0x70], ebx
cmp rbp, rbx
jne 0x100087e45
lea r8, [0x100009660]
lea rcx, [0x100009580]
mov edx, 0x20e
call fcn.10009a050
mov rcx, qword [0x1001653b8]
cmp esi, ebx
ja 0x100087e68
lea r8, [0x100009678]
lea rcx, [0x100009580]
mov edx, 0x20f
call fcn.10009a050
mov rcx, qword [0x1001653b8]
cmp r12, rbx
jne 0x100087e8c
lea r8, [0x100009688]
lea rcx, [0x100009580]
mov edx, 0x210
call fcn.10009a050
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x100087eb1
test byte [rcx + 0x1c], 1
je 0x100087eb1
cmp byte [rcx + 0x19], 4
jb 0x100087eb1
mov rcx, qword [rcx + 0x10]
mov edx, 0x26
mov r9, rbp
mov r8, r15
call fcn.10001db08
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rbp
mov dword [rsp + 0x28], 0x2000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x100087f44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x100088007
test byte [rcx + 0x1c], 1
je 0x100087fe5
cmp byte [rcx + 0x19], 2
jb 0x100087fe5
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x28]
mov r9, rbp
mov r8, r15
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
jmp 0x100087fde
lea r9, [rsp + 0x70]
mov r8d, esi
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x100087fb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x100087fd5
test byte [rcx + 0x1c], 1
je 0x100087fd5
cmp byte [rcx + 0x19], 2
jb 0x100087fd5
mov rcx, qword [rcx + 0x10]
mov edx, 0x28
mov r9d, eax
mov r8, r15
call fcn.10001c878
jmp 0x100087fd5
cmp esi, dword [rsp + 0x70]
je 0x100087fce
lea r8, [0x1000096a0]
lea rcx, [0x100009580]
mov edx, 0x233
call fcn.10009a050
lea rsi, [0x1001653b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x100088007
test byte [rcx + 0x1c], 1
je 0x100088007
cmp byte [rcx + 0x19], 4
jb 0x100088007
mov rcx, qword [rcx + 0x10]
mov edx, 0x29
mov r8, r15
call fcn.10001c854
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret
Function at 0x10008be6c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rbx, rcx
xor r12d, r12d
xor ecx, ecx
mov qword [rsp + 0x40], r12
mov rbp, rdx
call fcn.10008c5f4
mov rax, qword gs:[0x30]
movzx edi, word [rbx]
xor edx, edx
mov rcx, qword [rax + 0x60]
add edi, 0xe
mov rcx, qword [rcx + 0x30]
mov r8d, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, r12
jne 0x10008bec7
mov ebx, 0xc0000017
jmp 0x10008bf57
mov dword [rax], 1
mov dword [rax + 4], edi
mov dword [rax + 8], 3
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
lea rcx, [rax + 0xc]
call sub.msvcrt.dll_memcpy
movzx r11d, word [rbx]
lea r8, [rsp + 0x40]
shr r11, 1
xor edx, edx
mov rcx, rsi
mov word [rsi + r11*2 + 0xc], r12w
call fcn.10008c174
cmp eax, r12d
mov ebx, eax
jl 0x10008bf3b
mov rdi, qword [rsp + 0x40]
lea r8, [0x10014f440]
lea rdx, [0x10014f730]
mov rcx, rdi
call fcn.10008eda0
xor edx, edx
mov rcx, rdi
call fcn.10008c890
cmp eax, r12d
mov ebx, eax
jl 0x10008bf3b
mov qword [rbp], rdi
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret

Function at 0x10008dc08
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, 1
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [rbx + 0x13]
lea ecx, [rbx + 0x59]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x10008dc47
xor ebx, ebx
cmp dword [rsp + 0x30], 3
cmovl ebx, dword [rsp + 0x30]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.10014e600
add rsp, 0x40
pop rbx
ret

Function at 0x10008e47c
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
and qword [rsp + 0x50], 0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rdi, rcx
call fcn.10008e7d8
test eax, eax
js 0x10008e4ec
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x10008e4ec
mov rbx, qword [rsp + 0x50]
mov rsi, rax
mov rdx, qword [rbx]
lea r9, [rsp + 0x58]
mov r8d, 0xf003f
mov rcx, rdi
call fcn.10008e53c
test eax, eax
js 0x10008e4e2
mov rcx, qword [rsp + 0x58]
call fcn.10008e47c
test eax, eax
jns 0x10008e4e2
mov rcx, qword [rsp + 0x58]
call fcn.10008e200
add rbx, 8
sub rsi, 1
jne 0x10008e4b0
cmp qword [rsp + 0x50], 0
je 0x10008e512
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov ebx, eax
test eax, eax
js 0x10008e52a
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret