joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001280
Capabilities:
Manipulate user privileges

Disassembly:
push rbp
push rsi
mov rbp, rsp
sub rsp, 0x48
mov rsi, rcx
test rcx, rcx
jne 0x14000129b
xor eax, eax
add rsp, 0x48
pop rsi
pop rbp
ret
lea rcx, [rbp + 0x20]
call fcn.1400015b0
test eax, eax
je 0x1400012b4
mov eax, 1
add rsp, 0x48
pop rsi
pop rbp
ret
lea r8, [rbp + 0x20]
mov rcx, rsi
lea rdx, [rbp + 0x30]
call fcn.140001640
test eax, eax
je 0x1400012dd
mov rcx, qword [rbp + 0x20]
call sub.ADVAPI32.dll_LsaClose
mov eax, 2
add rsp, 0x48
pop rsi
pop rbp
ret
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbp + 0x30]
mov rcx, rdi
call fcn.140001c80
test rax, rax
je 0x14000130d
mov rcx, qword [rbp + 0x20]
call sub.ADVAPI32.dll_LsaClose
mov rdi, qword [rsp + 0x38]
mov eax, 3
add rsp, 0x48
pop rsi
pop rbp
ret
lea rcx, str.SeServiceLogonRight
mov rax, 0xffffffffffffffff
mov qword [rbp - 0x20], rcx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001320
mov rcx, qword [rbp + 0x20]
lea r9, [rbp + 0x18]
add ax, ax
mov qword [rsp + 0x40], rbx
mov word [rbp - 0x28], ax
lea r8, [rbp + 0x28]
add ax, 2
mov dword [rbp + 0x18], 0xffffffff
mov rdx, rdi
mov word [rbp - 0x26], ax
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
je 0x1400013ba
mov ecx, eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov ebx, eax
cmp eax, 2
je 0x1400013ba
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x20]
call sub.ADVAPI32.dll_LsaClose
mov ecx, ebx
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov r9, rbx
mov r8, rsi
mov edx, 0x40000209
call fcn.140002950
mov rbx, qword [rsp + 0x40]
mov eax, 4
mov rdi, qword [rsp + 0x38]
add rsp, 0x48
pop rsi
pop rbp
ret
mov edx, dword [rbp + 0x18]
xor ebx, ebx
test edx, edx
je 0x140001406
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbp - 0x28]
mov ecx, ebx
shl rcx, 4
add rcx, qword [rbp + 0x28]
cmp word [rcx], ax
jne 0x140001400
movzx r8d, word [rbp - 0x26]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rcx + 8]
call fcn.14001bedc
test eax, eax
je 0x14000147e
mov edx, dword [rbp + 0x18]
inc ebx
cmp ebx, edx
jb 0x1400013d0
mov rcx, qword [rbp + 0x28]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rbp + 0x20]
lea r8, [rbp - 0x28]
mov r9d, 1
mov rdx, rdi
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x20]
call sub.ADVAPI32.dll_LsaClose
test ebx, ebx
je 0x14000149b
mov ecx, ebx
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov r8, rbx
mov edx, 0x4000020a
call fcn.140002950
mov rbx, qword [rsp + 0x40]
mov eax, 5
mov rdi, qword [rsp + 0x38]
add rsp, 0x48
pop rsi
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x28]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rbp + 0x20]
call sub.ADVAPI32.dll_LsaClose
jmp 0x1400014b5
mov ecx, 1
call fcn.14001c1d0
mov rcx, rax
mov r8, rsi
mov edx, 0x40000204
call fcn.140002950
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x38]
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x140001ec0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rcx, rax
mov rdi, rax
call fcn.1400024d0
mov rcx, rax
call fcn.1400024c0
mov ebx, eax
test rdi, rdi
je 0x140001ef5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001f00
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdi, rax
test rax, rax
jne 0x140001f1a
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbx
call fcn.140001f50
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002030
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
jne 0x140002089
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r9, rax
mov qword [rsp + 0x20], 0
mov eax, 1
mov r8, rsi
movzx ecx, ax
mov edx, 0xc00003fe
call fcn.140002610
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rbx, rdi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400020e5
lea eax, [rbx + 1]
mov qword [rsp + 0x20], rbx
movzx ecx, ax
lea r9, str.expand_environment_string
lea r8, str.ExpandEnvironmentStrings__
mov edx, 0xc00003eb
call fcn.140002610
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x14000214c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r9, rax
mov qword [rsp + 0x20], 0
mov eax, 1
mov r8, rsi
movzx ecx, ax
mov edx, 0xc00003fe
call fcn.140002610
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400022e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movzx eax, word [rcx]
xor r15d, r15d
movzx r14d, dl
mov rsi, rcx
mov edi, r15d
test ax, ax
je 0x1400023c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rbx, rsi
test ax, ax
je 0x140002333
nop dword [rax]
cmp ax, 0x3d
je 0x140002339
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140002320
cmp ax, 0x3d
jne 0x1400023aa
mov word [rbx], r15w
test r14b, r14b
je 0x140002383
add rbx, 2
mov rcx, rbx
call fcn.140002030
mov rbp, rax
mov rcx, rsi
test rax, rax
je 0x14000237e
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002368
inc edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002394
mov rdx, rbx
jmp 0x140002388
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002394
inc edi
add rbx, 2
cmp word [rbx], r15w
je 0x1400023aa
nop
add rbx, 2
cmp word [rbx], r15w
jne 0x1400023a0
movzx eax, word [rbx + 2]
lea rsi, [rbx + 2]
test ax, ax
jne 0x140002311
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor edx, edx
jmp 0x1400022e0

Function at 0x1400023e0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbx
sub rsp, 0xe0
mov rbx, rcx
call fcn.140009dd0
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0xd4], ecx
xor r8d, r8d
mov qword [rsp + 0x60], rcx
mov rdx, rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x404
mov dword [rsp + 0x20], ecx
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002493
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add rsp, 0xe0
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xffffffff
mov edx, 1
cmp eax, 0x57
cmove ecx, edx
mov eax, ecx
add rsp, 0xe0
pop rbx
ret
Function at 0x1400024c0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movzx eax, word [rcx]
xor r15d, r15d
movzx r14d, dl
mov rsi, rcx
mov edi, r15d
test ax, ax
je 0x1400023c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rbx, rsi
test ax, ax
je 0x140002333
nop dword [rax]
cmp ax, 0x3d
je 0x140002339
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140002320
cmp ax, 0x3d
jne 0x1400023aa
mov word [rbx], r15w
test r14b, r14b
je 0x140002383
add rbx, 2
mov rcx, rbx
call fcn.140002030
mov rbp, rax
mov rcx, rsi
test rax, rax
je 0x14000237e
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002368
inc edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002394
mov rdx, rbx
jmp 0x140002388
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002394
inc edi
add rbx, 2
cmp word [rbx], r15w
je 0x1400023aa
nop
add rbx, 2
cmp word [rbx], r15w
jne 0x1400023a0
movzx eax, word [rbx + 2]
lea rsi, [rbx + 2]
test ax, ax
jne 0x140002311
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor edx, edx
jmp 0x1400022e0

Function at 0x140002510
Capabilities:
Get thread local storage value
Identify system language via api
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, ecx
mov ecx, dword [0x14003f688]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140002567
mov edx, 0xffff
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x140002558
lea rax, str._out_of_memory_for_error_message_
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov ecx, dword [0x14003f688]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov qword [rsp + 0x30], 0
mov r8d, edi
movzx r9d, ax
xor edx, edx
mov dword [rsp + 0x28], 0xffff
mov ecx, 0x1200
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1400025f8
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0xffff
mov r8d, edi
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1400025f8
lea r9, str.system_error__lu
mov dword [rsp + 0x20], edi
mov edx, 0xffff
mov r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.140001d80
test eax, eax
jns 0x1400025f8
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140002610
Capabilities:
Access the windows event log

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0xe8
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx edi, cx
lea rdx, str.nssm
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400026d1
xor r9d, r9d
lea rdx, [rsp + 0x110]
mov r8, qword [rdx]
mov ecx, r9d
test r8, r8
je 0x14000268b
nop dword [rax]
cmp ecx, 0xf
jge 0x14000268b
movsxd rax, ecx
add rdx, 8
inc ecx
mov qword [rsp + rax*8 + 0x50], r8
mov r8, qword [rdx]
test r8, r8
jne 0x140002670
mov qword [rsp + 0x40], r9
xor r8d, r8d
movsxd rax, ecx
movzx edx, di
mov qword [rsp + rax*8 + 0x50], r9
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r9d
mov word [rsp + 0x28], cx
mov rcx, rbx
mov qword [rsp + 0x20], r9
mov r9d, dword [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0xe8
pop rdi
pop rbx
ret

Function at 0x1400026f0
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov qword [rsp + 0x30], 0
mov r8d, ebx
movzx r9d, ax
xor edx, edx
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0xffff
mov ecx, 0xb00
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1400027a8
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0xffff
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xb00
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1400027a8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, str.system_error__lu
mov dword [rsp + 0x20], ebx
mov rcx, rax
mov qword [rsp + 0x58], rax
mov edx, 0xffff
mov r8, 0xffffffffffffffff
call fcn.140001d80
test eax, eax
jns 0x1400027a8
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rax, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
Function at 0x140003e00
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov r8, rbx
mov edx, 5
movzx r9d, ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x140003e63
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x717
jne 0x140003e73
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x140003e73
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140003e77
xor eax, eax
jmp 0x140003e8d
mov r9, rsi
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140006690
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x10440
call fcn.140018110
sub rsp, rax
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x10430], rax
mov qword [rsp + 0x28], r8
lea r9, str.NSSM_HOOK__s__s
mov qword [rsp + 0x20], rdx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov edx, 0x200
lea rcx, [rsp + 0x30]
mov r8, 0xffffffffffffffff
call fcn.140001d80
test eax, eax
jns 0x1400066ee
mov eax, 1
jmp 0x140006739
xor edx, edx
lea rcx, [rsp + 0x430]
mov r8d, 0x10000
call fcn.140019470
mov r8d, 0x8000
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rsp + 0x430]
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14000e0e0
neg eax
sbb eax, eax
and eax, 2
mov rcx, qword [rsp + 0x10430]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x10440
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007560
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
test rdx, rdx
je 0x1400075f1
test r8, r8
je 0x1400075f1
mov eax, dword [rdx]
mov dword [rsp + 0x30], eax
mov eax, dword [rdx + 4]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400075f1
mov ecx, dword [r8]
mov dword [rsp + 0x30], ecx
mov ecx, dword [r8 + 4]
mov dword [rsp + 0x34], ecx
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400075f1
cmp rdx, rax
jb 0x1400075f1
sub rdx, rax
lea r9, str._llu
movabs rax, 0x346dc5d63886594b
lea rcx, [rsp + 0x38]
mul rdx
shr rdx, 0xb
mov qword [rsp + 0x20], rdx
mov edx, 0x10
lea r8, [rdx - 0x11]
call fcn.140001d80
lea rdx, [rsp + 0x38]
jmp 0x1400075f8
lea rdx, [0x14002ee04]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x60
pop rbx
ret
Function at 0x140007de0
Capabilities:
Create pipe
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, qword [rsp + 0xb8]
mov r12d, r9d
mov rsi, qword [rsp + 0x88]
mov r13d, r8d
mov rbp, rdx
mov r15, rcx
mov ebx, 1
mov dword [r14], 0
test rsi, rsi
je 0x140007e66
cmp qword [rsi], 0
jne 0x140007e66
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x140007e66
cmp qword [rdi], 0
jne 0x140007e66
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140007eaf
mov rcx, qword [rdi]
mov r8d, ebx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x58]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x140007edb
xor ecx, ecx
lea r9, str.create_logging_thread__
mov qword [rsp + 0x20], rcx
lea r8, str.logger
movzx ecx, bx
mov edx, 0xc00003eb
call fcn.140002610
xor eax, eax
jmp 0x140007fc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r9, rbp
movzx ecx, bx
mov r8, r15
mov qword [rsp + 0x20], rax
mov edx, 0xc0000431
call fcn.140002610
xor eax, eax
jmp 0x140007fc2
mov eax, dword [rsp + 0xa0]
lea r8, [0x140008a00]
mov dword [rsp + 0xb8], eax
mov r9, rdi
mov eax, dword [rsp + 0xa8]
xor edx, edx
mov dword [rsp + 0xbc], eax
mov eax, dword [rsp + 0x80]
mov dword [rdi + 0x18], eax
mov qword [rdi], r15
mov qword [rdi + 8], rbp
mov dword [rdi + 0x10], r13d
mov dword [rdi + 0x14], r12d
mov rax, qword [rsi]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], r14
mov rcx, qword [rax]
mov rax, qword [rsp + 0xb8]
mov qword [rdi + 0x30], rax
movzx eax, byte [rsp + 0xc8]
mov byte [rdi + 0x48], al
mov rax, qword [rsp + 0xc0]
mov qword [rdi + 0x40], rax
mov eax, dword [rsp + 0xb0]
mov dword [rdi + 0x5c], eax
movzx eax, byte [rsp + 0xd0]
mov qword [rdi + 0x28], rcx
xor ecx, ecx
mov byte [rdi + 0x58], al
mov qword [rdi + 0x38], r14
mov qword [rdi + 0x50], rcx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x140007fbf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r8, rax
movzx ecx, bx
xor r9d, r9d
mov edx, 0xc0000424
call fcn.140002610
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140007fe0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r8
lea r9, str._s_s
mov rdi, rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x30]
mov edx, 0x1d
lea r8, [rdx - 0x1e]
call fcn.140001d80
test eax, eax
jns 0x140008051
xor ecx, ecx
lea r9, str.delete_createfile_parameter__
mov qword [rsp + 0x20], rcx
mov edi, 1
movzx ecx, di
mov r8, rbx
mov edx, 0xc00003eb
call fcn.140002610
mov eax, edi
jmp 0x140008068
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400180d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400093d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x60], rbx
mov rbp, r9
mov qword [rsp + 0x68], rdi
mov r15d, r8d
mov r12, rdx
mov r14, rcx
mov esi, 0x7d0
mov r13d, 1
mov rcx, qword [r14 + 0x20]
mov r9, rbp
mov r8d, r15d
mov qword [rsp + 0x20], 0
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400094bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x6d
je 0x140009469
cmp eax, 0x3e3
je 0x140009464
cmp eax, 0x718
je 0x140009449
mov ebx, 0xffffffff
jmp 0x140009454
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, r13d
add esi, 0xbb8
cmp esi, 0x4268
jl 0x140009403
jmp 0x14000946e
mov ebx, r13d
jmp 0x14000946e
mov ebx, 0xffffffff
mov rcx, qword [r14 + 0x40]
cmp dword [rcx], r13d
jne 0x1400094b7
mov rsi, qword [rsp + 0x80]
mov eax, dword [rsi]
test r13b, al
jne 0x1400094b2
mov ecx, edi
call fcn.140002510
mov r9, qword [r14 + 8]
mov edx, 0xc0000432
mov r8, qword [r14]
movzx ecx, r13w
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.140002610
mov eax, dword [rsi]
or eax, r13d
mov dword [rsi], eax
mov eax, ebx
jmp 0x1400094bd
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret

Function at 0x1400094e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x60], rbx
mov rsi, r9
mov qword [rsp + 0x68], r12
mov ebp, r8d
mov r15, rdx
mov r14, rcx
mov edi, 0x7d0
xor r13d, r13d
nop
mov rcx, qword [r14 + 0x28]
mov r9, rsi
mov r8d, ebp
mov qword [rsp + 0x20], r13
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400095b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
je 0x1400095b5
mov r12d, 1
cmp eax, 0x6d
je 0x140009571
cmp eax, 0x70
je 0x140009556
cmp eax, 0x718
jne 0x14000955e
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0xbb8
cmp edi, 0x4268
jl 0x140009510
mov esi, r12d
jmp 0x140009576
mov esi, 0xffffffff
mov rdi, qword [rsp + 0x80]
mov eax, dword [rdi]
test al, 2
jne 0x1400095ac
mov ecx, ebx
call fcn.140002510
mov r9, qword [r14 + 8]
mov edx, 0xc0000433
mov r8, qword [r14]
movzx ecx, r12w
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.140002610
mov eax, dword [rdi]
or eax, 2
mov dword [rdi], eax
mov eax, esi
jmp 0x1400095b7
xor eax, eax
mov r12, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret