joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000afc4
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x10001d1e0]
lea rax, [0x10001d1e0]
cmp rcx, rax
je 0x10000b008
test byte [rcx + 0x1c], 2
je 0x10000b008
cmp byte [rcx + 0x19], 5
jb 0x10000b008
mov rcx, qword [rcx + 0x10]
lea r8, [0x100015650]
mov edx, 0x5c
call fcn.10000121c
cmp dword [0x10001d1ac], 0
je 0x10000b06c
call fcn.10000f384
lea r11, [rsp + 0x50]
lea rdx, str.SYSTEMSetup
mov r9d, 0x2001b
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000b05e
mov rcx, qword [rsp + 0x50]
lea rdx, str.SetupShutdownRequired
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [rbx], 1
mov dword [rdi], 1
jmp 0x10000b08e
cmp dword [0x10001d1a8], 2
jne 0x10000b08e
call fcn.10000f384
mov rcx, rdi
call fcn.10000f86c
xor r8d, r8d
test eax, eax
setne r8b
mov dword [rbx], r8d
cmp dword [rbx], 0
jne 0x10000b11b
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x30]
lea rdx, str.SYSTEMSetup
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000b108
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SystemSetupInProgress
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [rsp + 0x50], 0
je 0x10000b11b
mov dword [rbx], 1
mov dword [rdi], 1
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x10000b7f0
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rcx, rdx
and qword [rsp + 0x30], rsi
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
mov edi, eax
test eax, eax
jne 0x10000b917
lea esi, [rax + 1]
lea r9, [rsp + 0x30]
lea edx, [rax + 8]
mov r8b, sil
mov rcx, 0xfffffffffffffffe
call qword [sym.imp.ntdll.dll_NtOpenThreadToken]
test eax, eax
jns 0x10000b845
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x10000b915
mov rdx, qword [0x10001dae0]
mov rcx, qword [rsp + 0x30]
and dword [rsp + 0x3c], 0
lea r8, [rsp + 0x88]
mov dword [rsp + 0x38], 0x13
mov rbx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x10000b90f
cmp dword [rsp + 0x88], 0
je 0x10000b895
and dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 0x18
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
and dword [rsp + 0x50], 0
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x48], rbx
call qword [sym.imp.ntdll.dll_NtPrivilegeCheck]
test eax, eax
jns 0x10000b8ca
cmp eax, 0xc0000061
jne 0x10000b8f6
mov al, byte [rsp + 0x80]
mov r8, qword [rsp + 0x30]
lea rcx, [0x10001daa0]
mov byte [rsp + 0x28], al
lea rax, [rsp + 0x40]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtPrivilegeObjectAuditAlarm]
test eax, eax
js 0x10000b838
cmp byte [rsp + 0x80], 0
jne 0x10000b917
mov edi, 5
jmp 0x10000b917
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10000b927
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x10000b931
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x60
pop rdi
ret
Function at 0x10000db58
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
mov eax, 0x18
mov rbp, rcx
mov rcx, qword [0x10001d210]
mov word [rsp + 0x30], ax
mov eax, 0x1a
mov edx, 8
mov word [rsp + 0x32], ax
lea rax, str.winlogon.exe
mov r8d, 0x80000
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x10000dd42
xor r9d, r9d
mov r8d, 0x80000
mov rdx, rax
lea ecx, [r9 + 5]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x10000dc88
mov rcx, qword [0x10001d1e0]
lea rsi, [0x10001d1e0]
cmp rcx, rsi
je 0x10000dc08
test byte [rcx + 0x1c], 0x20
je 0x10000dc08
cmp byte [rcx + 0x19], 2
jb 0x10000dc08
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x58
mov r9d, eax
call fcn.100001e70
mov ecx, dword [0x7ffe02d8]
mov edx, 2
mov r9, rbp
lea r8d, [rdx + 0x3a]
call fcn.100011dfc
test eax, eax
je 0x10000dc64
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000dc64
test byte [rcx + 0x1c], 0x20
je 0x10000dc64
cmp byte [rcx + 0x19], 2
jb 0x10000dc64
mov r9d, dword [0x7ffe02d8]
mov rcx, qword [0x10001d1e0]
lea r8, [0x1000155d0]
mov rcx, qword [rcx + 0x10]
mov edx, 0x59
mov dword [rsp + 0x20], eax
call fcn.10000a8d0
mov ebx, 1
mov edx, 2
mov r9, rbp
mov ecx, ebx
lea r8d, [rdx + 0x3a]
call fcn.100011dfc
inc ebx
cmp ebx, 0x64
jbe 0x10000dc69
jmp 0x10000dd38
cmp dword [rbx], 0
je 0x10000dd38
lea rsi, [0x10001d1e0]
lea rcx, [rbx + 0x38]
lea rdx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
jne 0x10000dd2a
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000dcdd
test byte [rcx + 0x1c], 0x20
je 0x10000dcdd
cmp byte [rcx + 0x19], 4
jb 0x10000dcdd
mov r9d, dword [rbx + 0x64]
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x5a]
lea r8, [0x1000155d0]
call fcn.100001e70
mov ecx, dword [rbx + 0x64]
mov edx, 2
mov r9, rbp
lea r8d, [rdx + 0x3a]
call fcn.100011dfc
test eax, eax
je 0x10000dd2a
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000dd2a
test byte [rcx + 0x1c], 0x20
je 0x10000dd2a
cmp byte [rcx + 0x19], 2
jb 0x10000dd2a
mov r9d, dword [rbx + 0x64]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x5b
mov dword [rsp + 0x20], eax
call fcn.10000a8d0
mov eax, dword [rbx]
add rbx, rax
cmp dword [rbx], 0
jne 0x10000dc98
lea rcx, [rsp + 0x58]
call fcn.1000031b0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x10000e310
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x170], rax
and dword [rsp + 0x30], 0
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
lea rdi, [0x10001d1e0]
test eax, eax
jne 0x10000e3e9
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, str.ShutdownSessionTimeout
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x10000e3e9
mov rcx, qword [0x10001d1e0]
cmp rcx, rdi
je 0x10000e3dd
test byte [rcx + 0x1c], 8
je 0x10000e3dd
cmp byte [rcx + 0x19], 4
jb 0x10000e3dd
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x67]
lea r8, [0x1000155d0]
call fcn.100001e70
mov rcx, qword [0x10001d1e0]
mov ebx, dword [rsp + 0x30]
imul ebx, ebx, 0xea60
jmp 0x10000e42d
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x118
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10000e421
cmp byte [rsp + 0x16a], 1
mov ebx, 0x2bf20
je 0x10000e426
mov ebx, 0xdbba0
mov rcx, qword [0x10001d1e0]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x10000e447
mov rcx, rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rcx, qword [0x10001d1e0]
cmp rcx, rdi
je 0x10000e470
test byte [rcx + 0x1c], 8
je 0x10000e470
cmp byte [rcx + 0x19], 5
jb 0x10000e470
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x68
mov r9d, ebx
call fcn.100001e70
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.100001000
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret

Function at 0x10000e7ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx r8d, cx
mov edi, ecx
xor ebp, ebp
shr r8d, 4
lea edx, [rbp + 6]
xor r9d, r9d
inc r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x10000e894
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10000e894
movzx esi, word [rax]
add rbx, 2
and edi, 0xf
je 0x10000e85d
movzx eax, si
lea rbx, [rbx + rax*2]
mov si, word [rbx]
add rbx, 2
add edi, 0xffffffff
jne 0x10000e84a
mov rcx, qword [0x10001d210]
movzx eax, si
mov edx, 8
inc eax
movsxd r8, eax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x10000e894
movzx r8d, si
mov rdx, rbx
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x10000e8b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
xor edi, edi
lea rax, [rax - 0x18]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [rax + 0x30], edi
mov qword [rax], rdi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10000e99d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.SaveDumpStart
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10000e99d
mov r8d, dword [rsp + 0x60]
mov rcx, qword [0x10001d210]
lea edx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x38], rax
cmp rax, rdi
je 0x10000e98e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.SaveDumpStart
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10000e98e
cmp dword [rsp + 0x68], 1
jne 0x10000e98e
cmp dword [rsp + 0x60], 2
jb 0x10000e98e
mov eax, dword [rsp + 0x60]
shr rax, 1
cmp word [rbx + rax*2 - 2], di
je 0x10000e9ac
cmp rbx, rdi
je 0x10000e99d
lea rcx, [rsp + 0x38]
call fcn.1000031b0
lea rcx, str._SystemRoot__system32WerFault.exe
call fcn.100004fb4
mov rbx, rax
mov rcx, qword [rsp + 0x30]
cmp rcx, rdi
je 0x10000e9bc
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x10000f86c
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rdi, rcx
lea rdx, str.SYSTEMSetup
xor ebx, ebx
mov r9d, 0x2001b
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10000f918
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.SetupShutdownRequired
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10000f90d
cmp dword [rsp + 0x68], 4
jne 0x10000f90d
mov eax, dword [rsp + 0x58]
cmp eax, 2
ja 0x10000f90d
mov rcx, qword [rsp + 0x30]
lea rdx, str.SetupShutdownRequired
mov dword [rdi], eax
mov ebx, 1
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100010f30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x180
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov edi, r8d
mov rsi, rcx
cmp dword [0x10001dd38], 0xffffffff
jne 0x1000110c3
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x54]
call sub.msvcrt.dll_memset
mov r12d, 0x40
mov dword [0x10001dd38], r12d
mov dword [rsp + 0x50], 0x11c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100010fc1
mov eax, dword [0x10001dd38]
lea ebx, [r12 - 0x30]
cmp byte [rsp + 0x16a], 1
cmove eax, ebx
mov dword [0x10001dd38], eax
jmp 0x100010fc6
mov ebx, 0x10
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x100011045
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.UIVerbosityLevel
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov ecx, dword [0x10001dd38]
test eax, eax
cmove ecx, dword [rsp + 0x30]
mov dword [0x10001dd38], ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000110c3
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.VerboseStatus
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1000110b8
cmp dword [rsp + 0x30], eax
cmovne ebx, r12d
mov dword [0x10001dd38], ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp edi, dword [0x10001dd38]
jbe 0x1000110cf
xor eax, eax
jmp 0x100011118
mov ebx, 0x15
call fcn.100010e54
test eax, eax
je 0x100011116
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], rsi
mov r9, qword [0x10001e028]
xor r8d, r8d
lea edx, [rbx - 0x10]
lea rcx, [0x100017a20]
call sub.RPCRT4.dll_NdrClientCall3
mov rbx, rax
mov dword [rsp + 0x44], eax
test eax, eax
jne 0x100011116
jmp 0x100011116
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.100001000
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x100011654
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov rcx, qword [0x10001dbd0]
test rcx, rcx
je 0x100011697
lea rdx, [0x100016c70]
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x100011697
mov rcx, qword [0x10001dbd0]
lea rdx, [0x100016c70]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_EtwEventWrite]
cmp qword [0x10001e028], 0
je 0x1000116ba
lea rcx, [0x10001e028]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
and qword [0x10001e028], 0
mov ebx, eax
jmp 0x1000116bc
xor ebx, ebx
and dword [0x10001e068], 0
mov rcx, qword [0x10001e038]
test edi, edi
je 0x100011729
test rcx, rcx
je 0x1000116e0
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x10001e038]
mov rax, qword [0x10001e070]
test rax, rax
je 0x100011729
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001170d
mov rcx, qword [0x10001e070]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x10001e070]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x10001e070], 0
mov rcx, qword [0x10001e038]
test rcx, rcx
je 0x10001173c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x10001e038], 0
mov rcx, qword [0x10001e030]
test rcx, rcx
je 0x100011756
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x10001e030], 0
mov rcx, qword [0x10001dbd0]
test rcx, rcx
je 0x10001178d
lea rdx, [0x100016c80]
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x10001178d
mov rcx, qword [0x10001dbd0]
lea rdx, [0x100016c80]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_EtwEventWrite]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100012008
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x10], 0
and dword [rax + 8], 0
xor esi, esi
mov dword [rax - 0x18], esi
lea rdx, [rax + 0x10]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_I_RpcBindingIsClientLocal]
test eax, eax
je 0x100012077
lea rdi, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rdi
je 0x1000121bd
test byte [rcx + 0x1c], 1
je 0x1000121bd
cmp byte [rcx + 0x19], 2
jb 0x1000121bd
lea edx, [rsi + 0xc]
mov r9d, eax
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x1000121bd
cmp dword [rsp + 0x48], 0
jne 0x1000120c3
lea rdi, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rdi
je 0x1000121bd
test byte [rcx + 0x1c], 1
je 0x1000121bd
cmp byte [rcx + 0x19], 2
jb 0x1000121bd
mov edx, 0xd
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.10000121c
jmp 0x1000121bd
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
test eax, eax
je 0x100012117
lea rdi, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rdi
je 0x1000121bd
test byte [rcx + 0x1c], 1
je 0x1000121bd
cmp byte [rcx + 0x19], 2
jb 0x1000121bd
mov edx, 0xe
mov r9d, eax
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x1000121bd
mov esi, 1
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x40]
lea rdx, [0x100016de0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x100012171
lea rdi, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rdi
je 0x10001216a
test byte [rcx + 0x1c], sil
je 0x10001216a
cmp byte [rcx + 0x19], 2
jb 0x10001216a
lea edx, [rsi + 0xe]
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.10000121c
and dword [rsp + 0x40], 0
jmp 0x1000121bd
lea rdi, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rdi
je 0x1000121bd
test byte [rcx + 0x1c], sil
je 0x1000121bd
cmp byte [rcx + 0x19], 2
jb 0x1000121bd
lea rax, str.TRUE
lea r9, str.FALSE
cmp dword [rsp + 0x40], 0
cmovne r9, rax
mov edx, 0x10
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100011ed0
nop
test esi, esi
je 0x1000121f8
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
test eax, eax
je 0x1000121f8
mov rcx, qword [0x10001d1e0]
cmp rcx, rdi
je 0x1000121f8
test byte [rcx + 0x1c], 1
je 0x1000121f8
cmp byte [rcx + 0x19], 2
jb 0x1000121f8
mov edx, 0x11
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.10000121c
mov eax, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x100012660
Capabilities:
Access the windows event log

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
xor r8d, r8d
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x80]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, ebx
jne 0x1000126b3
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x100012e64
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov r8d, dword [0x10001d94c]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x100012f11
lea rcx, [0x100019150]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x100012f08
lea rdx, str.DbgBreakPoint
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x100012f08
lea rcx, [rsp + 0x58]
mov r9, rax
xor edx, edx
mov qword [rsp + 0x30], rcx
mov rcx, rdi
mov r8d, 0x8000
mov dword [rsp + 0x28], 4
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x100012f08
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100012f38
Capabilities:
Create thread
Query or enumerate registry value
Resume thread

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x18], 0
and qword [rax + 0x20], 0
and dword [rax + 0x10], 0
mov dword [rax + 8], 0x80
mov eax, dword [0x10001de10]
cmp eax, 0xffffffff
jne 0x10001304c
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x100012fd7
lea rdx, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rdx
je 0x1000130ae
test byte [rcx + 0x1c], bl
je 0x1000130ae
cmp byte [rcx + 0x19], 2
jb 0x1000130ae
lea edx, [rbx + 0xd]
mov r9d, eax
lea r8, [0x100014810]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x1000130ae
mov ecx, dword [rsp + 0x60]
add rcx, rcx
call fcn.10000447c
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1000130ae
mov esi, 0x30
mov word [rax], si
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.ReportBootOk
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
and dword [0x10001de10], 0
xor eax, eax
cmp word [rdi], si
cmovne eax, ebx
mov dword [0x10001de10], eax
lea rcx, [rsp + 0x30]
call fcn.100005288
mov eax, dword [0x10001de10]
jmp 0x100013051
mov ebx, 1
cmp eax, ebx
jne 0x1000130ae
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea r8, [0x100012f24]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1000130a5
mov edx, 0xfffffffe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000130ae
mov ecx, ebx
call qword [sym.imp.ADVAPI32.dll_NotifyBootConfigStatus]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1000130be
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret