joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400840b0
Capabilities:
Encode data using xor

Disassembly:
xor dh, ch
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
xor dl, ah
pop rdx
pop rax
and byte [rdx + rbx*2 + 0x58], ch
loopne 0x1400840a1
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
out 0x5a, eax
pop rax
nop
push 0xffffffffee10585a
pop rdx
pop rax
adc dh, ch
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
add bh, ah
pop rdx
pop rax
add byte [rdx + rbx*2 + 0x58], ch
test al, 0xe9
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
cdq
pop rdx
pop rax
pop rax
push 0xffffffffef80585a
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
outsb dx, byte [rsi]
cdq
pop rdx
pop rax
mov al, 0x6d
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
pop rax
stosb byte [rdi], al
cwde
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rax
mov ds, word [rax + 0x5858585a]
pop rax
pop rax
loop 0x1400840c7
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rax
ret 0x5a98

Function at 0x14008a260
Capabilities:
Encode data using xor

Disassembly:
pop rax
mov eax, 0xa0585930
xor byte [rcx + 0x58], bl
call 0x19860fd5e
xor dword [rcx + 0x58], ebx
pop rcx
xor dword [rcx + 0x58], ebx
in al, dx
invalid

Function at 0x14008bc60
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov r15, rdx
mov r12, rcx
lea r8, [0x14011eaa0]
mov rdx, r14
mov rcx, r15
mov rdi, r9
call fcn.1400e86e4
mov rsi, qword [rsp + 0x70]
lea rdx, [rsp + 0x68]
xor eax, eax
mov rcx, r12
mov qword [rdi], rax
mov qword [rsi], rax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
jne 0x14008bcc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rcx, rbp
mov qword [rsp + 0x50], rbx
call fcn.1400e8270
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r12
mov rbx, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14008bd62
mov edx, dword [rbx + 0x30]
mov r9, r14
mov ecx, dword [rbx + 0x34]
mov r8, r15
call fcn.1400a8720
lea rdx, [0x14011f4f8]
mov rcx, rbx
call fcn.1400ab6a0
test rax, rax
jne 0x14008bd24
lea rdx, str.ProductDescription
mov rcx, rbx
call fcn.1400ab6a0
test rax, rax
je 0x14008bd2f
mov rcx, rax
call fcn.1400e81d8
mov qword [rdi], rax
lea rdx, [0x14011f518]
mov rcx, rbx
call fcn.1400ab6a0
test rax, rax
jne 0x14008bd57
lea rdx, [0x140133288]
mov rcx, rbx
call fcn.1400ab6a0
test rax, rax
je 0x14008bd62
mov rcx, rax
call fcn.1400e81d8
mov qword [rsi], rax
mov rcx, rbx
call fcn.1400e825c
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14008c260
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rdi, rdx
call fcn.1400e81d8
mov rbx, 0xffffffffffffffff
mov rbp, rax
mov rdx, rbx
inc rdx
cmp word [rax + rdx*2], si
jne 0x14008c283
inc rdx
mov rcx, rbp
call fcn.1400e926c
lea rdx, str.SVCHOST.EXE
mov rcx, rbp
call fcn.1400e3cd4
test rax, rax
je 0x14008c395
nop
inc rbx
cmp word [rdi + rbx*2], si
jne 0x14008c2b0
add rbx, 0x2e
lea rcx, [rbx + rbx]
call fcn.1400e8270
mov r9, rdi
lea r8, str.SystemCurrentControlSetServices_s
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call fcn.1400192b0
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008c430
mov rcx, qword [rsp + 0x78]
lea rdx, str.ServiceDll
call fcn.140089b60
mov rsi, rax
test rax, rax
jne 0x14008c430
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, rdi
lea r8, str.SystemCurrentControlSetServices_sParameters
mov rdx, rbx
mov rcx, rbp
call fcn.1400192b0
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008c430
mov rcx, qword [rsp + 0x78]
lea rdx, str.ServiceDll
call fcn.140089b60
mov rcx, qword [rsp + 0x78]
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008c430
mov rcx, qword [0x14018f9b0]
mov r8d, 5
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14008c3c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ecx, dword [rsp + 0x70]
call fcn.1400e8270
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbp + 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
je 0x14008c430
mov ecx, ebx
add rcx, rcx
call fcn.1400e8270
mov rcx, qword [rbp + 0x10]
mov r8d, ebx
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbp
call fcn.1400e825c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008c4b4
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov ebp, eax
test eax, eax
je 0x14008c4b4
lea rcx, [rbp*2]
call fcn.1400e8270
mov rdi, rax
mov r9d, ebp
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov edx, ebp
mov rcx, rdi
call fcn.1400e8fb8
mov rcx, rsi
call fcn.1400e825c
mov rsi, rdi
mov rbx, qword [rsp + 0x60]
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d6f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], 0
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14008d892
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x140124b48]
lea rax, [rsp + 0x260]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008d887
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.1400e926c
lea r8, [rsp + 0x38]
mov dword [rsp + 0x30], 0x204
lea rdx, str.SoftwareSysinternalsProcess_Explorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14008d7db
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.OriginalPath
lea rax, [rsp + 0x52]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008d7ee
mov r8d, 0x102
lea rdx, [rsp + 0x52]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008d7fe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x22
lea r8, [0x140125380]
mov edx, 0x104
mov word [rsp + 0x50], ax
lea rcx, [rsp + 0x50]
call fcn.1400f7f64
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400e926c
mov edx, 0x5c
lea rcx, [rsp + 0x260]
call fcn.1400e3c28
mov edx, 0x5c
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.1400e3c28
mov rdx, rax
test rax, rax
je 0x14008d887
test rbx, rbx
je 0x14008d887
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x14008d874
add rbx, 2
test eax, eax
jne 0x14008d861
test ecx, ecx
jne 0x14008d887
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14008d894
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x480
pop rbx
ret
Function at 0x14008da10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x860], rax
lea rax, [rsp + 0x50]
xor esi, esi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareSysinternalsProcess_ExplorerProcessComments
mov rcx, 0xffffffff80000001
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008dba7
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], 0x400
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14008db9c
mov qword [rsp + 0x880], rbx
mov ebx, esi
mov rcx, qword [0x14018e780]
lea eax, [rdi + 2]
movsxd rdx, eax
shl rdx, 4
call fcn.1400e8278
lea rcx, [rsp + 0x60]
mov qword [0x14018e780], rax
call fcn.1400e81d8
mov rcx, qword [0x14018e780]
mov qword [rbx + rcx], rax
mov ecx, dword [rsp + 0x44]
call fcn.1400e8270
mov rcx, qword [0x14018e780]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, edi
mov qword [rbx + rcx + 8], rax
lea rax, [rsp + 0x44]
add dword [rsp + 0x40], 2
mov qword [rsp + 0x38], rax
mov rax, qword [0x14018e780]
mov rcx, qword [rbx + rax + 8]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov rax, qword [0x14018e780]
lea rbx, [rbx + 0x10]
inc edi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, edi
mov qword [rbx + rax], rsi
lea rax, [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], 0x400
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14008dab1
mov rbx, qword [rsp + 0x880]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400e17a0
mov rsi, qword [rsp + 0x888]
add rsp, 0x870
pop rdi
ret
Function at 0x14008dce0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x370], rax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], 0
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14008dee7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x140124b48]
lea rax, [rbp + 0x160]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008dedc
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.1400e926c
lea r8, [rsp + 0x38]
mov dword [rsp + 0x30], 0x204
lea rdx, str.SoftwareSysinternalsProcess_Explorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14008ddd4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.OriginalPath
lea rax, [rsp + 0x52]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008dde7
mov r8d, 0x102
lea rdx, [rsp + 0x52]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008ddf7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x22
lea r8, [0x140125380]
mov edx, 0x104
mov word [rsp + 0x50], ax
lea rcx, [rsp + 0x50]
call fcn.1400f7f64
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400e926c
mov edx, 0x5c
lea rcx, [rbp + 0x160]
call fcn.1400e3c28
mov edx, 0x5c
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.1400e3c28
mov r9, rax
test rax, rax
je 0x14008dedc
test rbx, rbx
je 0x14008dedc
sub r9, rbx
movzx r8d, word [rbx]
movzx eax, word [rbx + r9]
sub r8d, eax
jne 0x14008de77
add rbx, 2
test eax, eax
jne 0x14008de61
test r8d, r8d
jne 0x14008dedc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14008debd
mov rcx, qword [rsp + 0x48]
lea rdx, [0x140124b48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x48]
jmp 0x14008dee1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [0x14018ec78]
lea rcx, str.Error_restoring_Task_Manager
call fcn.1400c56e0
xor al, al
jmp 0x14008dee9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rbp
ret
Function at 0x14008e2b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x100d0
call fcn.1400e1740
sub rsp, rax
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x100c0], rax
xor ebp, ebp
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14008e34c
lea rax, str._Error_opening_file_
mov dword [rsp + 0x50], 5
lea r9, [rsp + 0x50]
mov qword [rsp + 0x68], rax
xor r8d, r8d
mov dword [rsp + 0x54], 0x7fffffff
mov edx, 0x104d
mov qword [rsp + 0x78], 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
xor al, al
jmp 0x14008e425
mov rax, qword [0x14018ef88]
mov qword [rsp + 0x10100], rsi
test rax, rax
jne 0x14008e374
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x14018ef88], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, 0x10008
lea rdx, [rsp + 0xb0]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008e409
mov r9d, dword [rsp + 0x40]
test r9d, r9d
je 0x14008e409
lea r8, [rsp + 0xb0]
mov edx, 3
mov rcx, rdi
call fcn.140089f20
cmp dword [rsp + 0x40], 0x10008
jne 0x14008e3e4
mov r9d, 1
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 - 3]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, 0x10008
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14008e3a5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetCursor]
mov rsi, qword [rsp + 0x10100]
mov al, 1
mov rcx, qword [rsp + 0x100c0]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x100d0
pop rdi
pop rbp
pop rbx
ret
Function at 0x14008f340
Capabilities:
Compare security identifiers

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov dword [rsp + 0x78], 0
cmp byte [0x14018e998], bl
mov word [rsp + 0x7c], 0x500
mov qword [rsp + 0x68], rbx
jne 0x14008f4a2
mov qword [rsp + 0xa8], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x70]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea rax, [rsp + 0x68]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x48], ebx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x40], ebx
mov dl, 2
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rsp + 0x60]
call fcn.1400e8270
mov r9d, dword [rsp + 0x60]
lea edx, [rbx + 2]
mov rcx, qword [rsp + 0x70]
mov rdi, rax
lea rax, [rsp + 0x60]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14008f475
cmp ebx, dword [rdi]
jae 0x14008f46e
mov qword [rsp + 0xa0], rsi
nop
mov rcx, qword [rsp + 0x68]
mov esi, ebx
add rsi, rsi
mov rdx, qword [rdi + rsi*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14008f45e
mov eax, dword [rdi + rsi*8 + 0x10]
test eax, 0xffffffef
setne cl
test al, 4
setne al
test al, cl
jne 0x14008f464
inc ebx
cmp ebx, dword [rdi]
jb 0x14008f430
mov rsi, qword [rsp + 0xa0]
cmp ebx, dword [rdi]
setne byte [0x14018e999]
mov rcx, rdi
call fcn.1400e825c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0xa8]
mov byte [0x14018e998], 1
movzx eax, byte [0x14018e999]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x90
pop rbx
ret
Function at 0x140090520
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x90]
mov edi, edx
mov edx, dword [rcx + 0x18]
mov rsi, rcx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400905a0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140090597
mov eax, dword [rsi + 0x18]
cmp dword [rsp + 0x2c], eax
jne 0x140090586
cmp dword [rsp + 0x28], edi
je 0x1400905c2
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140090577
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov r8d, edi
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x140090597
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, rdi
test eax, eax
jne 0x1400905f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140090597
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400905a5
Function at 0x1400913a0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
sub rsp, 0x680
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov r15, qword [rsp + 0x6c0]
mov r14, rdx
mov edx, dword [rcx + 0xc]
mov rbx, rcx
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140091409
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x140091410
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400914c0
mov qword [rsp + 0x6a8], rbp
xor ebp, ebp
mov qword [rsp + 0x6b0], rdi
lea rdi, str.clr.dll
nop dword [rax]
mov eax, dword [rbx + 0xc]
cmp dword [rsp + 0x28], eax
jne 0x140091491
mov rax, rbp
lea rdx, [rsp + 0x50]
movzx ecx, word [rdi + rax*2]
inc rax
cmp cx, word [rdx + rax*2 - 2]
jne 0x140091491
cmp rax, 8
jne 0x140091441
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub ebx, eax
mov edi, 0x7ffffffe
movsxd r9, ebx
mov ebx, 0x105
cmp r9, rdi
jbe 0x1400914e5
mov word [rsp + 0x460], bp
jmp 0x140091534
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x140091430
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov rbp, qword [rsp + 0x6a8]
mov rdi, qword [rsp + 0x6b0]
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x680
pop r15
pop r14
pop rsi
ret
lea r8, [rsp + 0x250]
mov rdx, rbx
lea rax, [rsp + 0x460]
sub r8, rax
lea rcx, [rsp + 0x460]
lea rax, [r9 - 0x105]
add rax, rdx
je 0x140091526
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140091526
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140091503
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
lea rax, [rsp + 0x460]
cmp word [rax], bp
je 0x140091557
add rax, 2
sub rcx, 1
jne 0x140091548
mov rax, rbx
sub rax, rcx
test rcx, rcx
cmove rax, rbp
je 0x1400915ad
lea rcx, [rsp + 0x460]
lea rcx, [rcx + rax*2]
sub rbx, rax
je 0x14009159f
sub r14, rcx
nop word [rax + rax]
test rdi, rdi
je 0x14009159f
movzx eax, word [r14 + rcx]
test ax, ax
je 0x14009159f
mov word [rcx], ax
dec rdi
add rcx, 2
sub rbx, 1
jne 0x140091580
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bp
xor edx, edx
lea rcx, [rsp + 0x460]
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x1400914ab
mov qword [r15], rax
xor eax, eax
jmp 0x1400914b0

Function at 0x1400919d0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, edx
mov ecx, 0x1fffff
mov edx, 1
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
jne 0x1400919fc
mov eax, 0x80004005
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400947e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
cmp byte [0x14018e9a0], 0
je 0x140094821
mov rax, qword [0x14018e9a8]
lea rcx, [0x14018e9a8]
mov qword [0x14018e9b0], rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r8, str..NET_CLR_Memory_.NET_CLR_Exceptions_.NET_CLR_Remoting_.NET_CLR_LocksAndThreads_.NET_CLR_Security_.NET_CLR_Jit_.NET_CLR_Loading_.NET_CLR_Interop_.NET_CLR_Data
xor edx, edx
lea rcx, [0x14018e9e0]
add rsp, 0x28
jmp fcn.140098320
add rsp, 0x28
ret