joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063200
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x40]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1400e3ad0]
mov r8, qword [rbx]
mov ecx, dword [rbx + 0x20]
shr ecx, 1
sbb ecx, ecx
lea r14, [r8 - 5]
test ecx, ecx
lea rdi, [r8 - 5]
mov eax, ecx
cmove r14, r8
neg eax
sbb rbp, rbp
and ebp, 2
add rbp, 5
test ecx, ecx
mov rdx, rbp
cmove rdi, r8
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140063272
mov eax, 0xa
jmp 0x1400632f9
test esi, esi
je 0x140063295
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, r14d
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1400632b6
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1400632b6
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1400632b0
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1400632b6
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and dword [rbx + 0x20], 0xfffffff9
and esi, 1
mov ecx, esi
and ecx, 0xfffffffd
lea eax, [rsi + rsi]
or ecx, eax
add ecx, ecx
or dword [rbx + 0x20], ecx
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400639a0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x140063a06
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1400639f7
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1400639ed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1400639c1
mov r8, qword [rbx]
mov rcx, qword [0x1400e2808]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140063d7c
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x140063d93
cmp r8b, 0x90
je 0x140063d93
cmp r8b, 0xcc
jne 0x140063db5
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x140063db1
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x140063db5
add edx, r10d
cmp edx, r9d
jb 0x140063da1
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x140064cfc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140064d22
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140065be4
jmp 0x140064d8d
cmp byte [0x1400e2b00], 0
jne 0x140064d66
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140064d56
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e2af8], rax
jmp 0x140064d5d
mov rax, qword [0x1400e2af8]
mov byte [0x1400e2b00], 1
jmp 0x140064d6d
mov rax, qword [0x1400e2af8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140064d87
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [0x140086148]
jmp 0x140064d8d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140065be4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140065c4b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140065c5f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140065c5f
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [0x140086148]
jmp 0x140065c64
cmp dword [rcx + 8], 0
je 0x140065c5f
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140065c64
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140065e9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1400dbc58]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140065f20
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140065f20
call fcn.140064ba0
mov ebx, eax
jmp 0x140066029
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140065f41
call fcn.140064ba0
jmp 0x140066018
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140065f37
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140065f7c
mov ebx, 0x8007000e
jmp 0x14006601a
mov ecx, eax
test eax, eax
je 0x140065fae
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140066061
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140065fae
lea rcx, [rsp + 0x60]
call fcn.140064a28
jmp 0x140065fb8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x140065fca
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140065f72
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140065f37
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140065d30
mov ebx, eax
test rsi, rsi
je 0x140066029
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140066040
lea rcx, [rsp + 0x60]
call fcn.140064d98
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14007e630
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140006c40
int3
Function at 0x1400678d4
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x1400dbc58]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
call fcn.140009550
call fcn.14006d91c
xor r14d, r14d
mov dword [rbp - 0x49], r14d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x49]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov qword [rbp + 0x27], r14
mov qword [rbp + 0x37], r14
mov qword [rbp + 0x3f], r14
mov qword [rbp + 0x37], r14
mov qword [rbp + 0x3f], 7
mov word [rbp + 0x27], r14w
lea r8d, [r14 + 0xa]
lea rdx, str._user_path
lea rcx, [rbp + 0x27]
call fcn.1400022b0
nop
movsxd rax, dword [rbp - 0x49]
lea rdx, [rbx + rax*8]
lea r8, [rbp + 0x27]
mov rcx, rbx
call fcn.14006e1ec
mov rbx, rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x1400679b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400679ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400679ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007e34c
mov qword [rbp + 0x37], r14
mov qword [rbp + 0x3f], 7
mov word [rbp + 0x27], r14w
mov edx, 1
mov rcx, rbx
call fcn.140075fcc
lea rcx, [rbp - 0x45]
call fcn.140013314
nop
mov edx, 1
mov ecx, 0xe1b75
call fcn.14000f320
call fcn.1400674dc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
xor r9d, r9d
mov r8, rdi
xor edx, edx
lea rcx, [0x1400e2a90]
call fcn.140064e08
test eax, eax
jne 0x140067aa6
call fcn.14006775c
mov qword [0x1400e2a78], rdi
call fcn.140062480
test rax, rax
je 0x140067a9a
xor r8d, r8d
xor edx, edx
lea rcx, [0x140064f20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
lea rbx, [0x140088c58]
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x19], r14
lea rcx, [rbp - 0x39]
call fcn.140014330
nop
mov qword [rbp - 0x39], rbx
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140067a7f
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x19], r14
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140067a96
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x29], r14
lea rcx, [0x1400e2a90]
call fcn.140066a58
call fcn.1400760c8
call fcn.14000f350
nop
lea rcx, [rbp - 0x45]
call fcn.140013528
mov eax, 0x80004005
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14007e630
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14006afdc
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14006b16b
cmp ecx, 0x7c
je 0x14006b16b
cmp ecx, 0x29
jne 0x14006b024
cmp dword [rbx + 0x1c], 0
jne 0x14006b16b
test dword [rbx + 0x80], 0x10000000
je 0x14006b184
jmp 0x14006b119
cmp ecx, 0x2e
jne 0x14006b044
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.14006d0d0
mov rcx, rbx
call fcn.14006d128
jmp 0x14006b159
cmp ecx, 0x5c
jne 0x14006b0a5
mov rcx, rbx
call fcn.14006d128
test byte [rbx + 0x80], 0x80
je 0x14006b098
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x14006b07c
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.14006d0d0
mov rcx, rbx
call fcn.14006d128
jmp 0x14006b161
cmp al, 0x42
jne 0x14006b098
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.14006d0d0
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x14006b06f
mov rcx, rbx
call fcn.14006b1b0
jmp 0x14006b159
cmp ecx, 0x5b
jne 0x14006b0c9
mov rcx, rbx
call fcn.14006d128
mov rcx, rbx
call fcn.14006b654
cmp dword [rbx + 0x7c], 0x5d
jne 0x14006b192
jmp 0x14006b037
cmp ecx, 0x28
jne 0x14006b0ed
mov rcx, rbx
call fcn.14006d128
mov rcx, rbx
call fcn.14006d768
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x14006b184
jmp 0x14006b14c
cmp ecx, 0x5e
jne 0x14006b0fa
lea edx, [rcx - 0x5c]
jmp 0x14006b066
cmp ecx, 0x24
jne 0x14006b107
lea edx, [rcx - 0x21]
jmp 0x14006b066
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14006b176
cmp ecx, 0x3f
je 0x14006b176
cmp ecx, 0x7b
je 0x14006b176
cmp ecx, 0x7d
jne 0x14006b12c
test dword [rbx + 0x80], 0x10000000
je 0x14006b1a0
jmp 0x14006b13d
cmp ecx, 0x5d
jne 0x14006b13d
test dword [rbx + 0x80], 0x10000000
je 0x14006b192
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14006a648
mov dil, 1
mov rcx, rbx
call fcn.14006d128
test dil, dil
je 0x14006b161
mov rcx, rbx
call fcn.14006d178
mov ecx, dword [rbx + 0x7c]
mov al, 1
jmp 0x14006afee
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.14001a898
int3
mov edx, 5
mov rcx, rbx
call fcn.14001a898
int3
mov edx, 4
mov rcx, rbx
call fcn.14001a898
int3
mov edx, 6
mov rcx, rbx
call fcn.14001a898
int3
Function at 0x14006dc48
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov ecx, 0x1000
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14006dc69
mov ebx, 1
jmp 0x14006dd05
and qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlTerminal_Server_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006dcf5
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.GlassSessionId
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006dcf5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14006dcf5
mov ecx, dword [rsp + 0x58]
cmp dword [rsp + 0x60], ecx
setne bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14006dd05
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x14006ef80
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rbp, rdx
mov esi, ecx
test rdx, rdx
jne 0x14006efa7
xor al, al
jmp 0x14006f09f
xor dil, dil
mov byte [rsp + 0x88], dil
test esi, esi
je 0x14006f09c
mov r8d, esi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14006efee
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14006f09c
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x88]
lea rax, [rsp + 0x78]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea rdx, str.QueryFullProcessImageNameW
lea rax, [rsp + 0x40]
lea rcx, str.kernel32.dll
mov qword [rsp + 0x20], rax
call fcn.140068f1c
mov dil, byte [rsp + 0x88]
test dil, dil
jne 0x14006f093
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, dword [rsp + 0x80]
mov r8, rbp
mov rcx, rax
xor edx, edx
mov rbx, rax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
setne dil
test eax, eax
jne 0x14006f093
mov r8d, dword [rsp + 0x80]
mov rdx, rbp
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
setne dil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14006f16c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400dbc58]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov eax, dword [0x1400e2b90]
test eax, eax
jne 0x14006f278
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006f276
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.CurrentMajorVersionNumber
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006f26b
cmp dword [rsp + 0x40], 0xa
jb 0x14006f26b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.ReleaseId
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006f26b
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov rcx, qword [rsp + 0x38]
mov dword [0x1400e2b90], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1400e2b90]
jmp 0x14006f278
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14007e630
add rsp, 0x270
pop rbp
ret
Function at 0x14006f2f8
Capabilities:
Get process image filename

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, rdx
xor edi, edi
lea rdx, [rbp + 0x38]
mov dword [rbp + 0x38], edi
mov ebx, r8d
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x48], ebx
mov qword [rbp - 8], r15
test r15, r15
je 0x14006f40b
mov sil, dil
mov byte [rbp + 0x40], dil
cmp dword [rbp + 0x38], edi
je 0x14006f408
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14006f371
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14006f408
lea rax, [rbp + 0x48]
mov dword [rbp - 0x10], edi
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x40]
lea rax, [rbp - 8]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea rdx, str.QueryFullProcessImageNameW
lea rax, [rbp - 0x10]
lea rcx, str.kernel32.dll
mov qword [rsp + 0x20], rax
call fcn.140068f1c
mov sil, byte [rbp + 0x40]
test sil, sil
jne 0x14006f3ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, dword [rbp + 0x48]
mov r8, r15
mov rcx, rax
xor edx, edx
mov rbx, rax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
setne sil
test eax, eax
jne 0x14006f3ff
mov r8d, dword [rbp + 0x48]
mov rdx, r15
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
setne sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, sil
mov al, dil
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14006f4cc
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.dwmapi.dll
call fcn.14007020c
lea rcx, str.uxtheme.dll
mov qword [0x1400e2b28], rax
call fcn.14007020c
mov rcx, qword [0x1400e2b28]
mov qword [0x1400e2b30], rax
test rcx, rcx
je 0x14006f538
lea rdx, str.DwmIsCompositionEnabled
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400e2b28]
lea rdx, str.DwmGetWindowAttribute
mov qword [0x1400e2b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e2b48], rax
mov rax, qword [0x1400e2b30]
test rax, rax
je 0x14006f5a5
lea rdx, str.DrawThemeTextEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400e2b30]
lea rdx, str.OpenThemeData
mov qword [0x1400e2b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400e2b30]
lea rdx, str.CloseThemeData
mov qword [0x1400e2b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400e2b30]
lea rdx, str.GetThemeSysFont
mov qword [0x1400e2b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400e2b68], rax
add rsp, 0x28
jmp fcn.14006dd10
Function at 0x14006f7f4
Capabilities:
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x1400dbc58]
xor rax, rsp
mov qword [rsp + 0x430], rax
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x14006f8b2
cmp di, word [rcx]
je 0x14006f8b2
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x410
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea r8d, [rdi + 0x25]
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14006f8b2
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
cmp eax, edi
jne 0x14006f8ae
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.downlevel
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x14006f8b2
mov al, 1
jmp 0x14006f8b4
xor al, al
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14007e630
mov rbx, qword [rsp + 0x458]
add rsp, 0x440
pop rdi
ret

Function at 0x14006fc64
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1400dbc58]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov word [rbp - 0x21], 0x500
mov qword [rbp - 0x39], rbx
mov dword [rbp - 0x25], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x39]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14006fcd9
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x29]
lea r9d, [rbx + 0x54]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x19]
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x39]
test eax, eax
jne 0x14006fcf8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14007e630
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp - 0x31]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x25]
mov dword [rsp + 0x48], ebx
mov dl, 1
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
lea r8d, [r9 + 0x12]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14006fcd9
mov rdx, qword [rbp - 0x31]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp - 0x31]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
jmp 0x14006fcdb