joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bd5d0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
mov rbx, r8
mov rbp, rdx
not rcx
dec rcx
mov rsi, rcx
add rcx, rcx
call qword [fcn.14016d5e4]
mov rdi, rax
test rax, rax
jne 0x1401bd617
lea eax, [rdi + 0x1b]
jmp 0x1401bd6d3
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1401bd5a0
lea rcx, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401bd6c0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1401bd6b3
mov rcx, qword [rsp + 0x30]
lea r8d, [rsi + rsi]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x68], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbx
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbx + 0x10], eax
mov byte [rbx + 0x14], al
call qword [fcn.14016d5a4]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1401c0130
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rdi, r8
cmp dword [rcx + 8], 3
mov rsi, rdx
jne 0x1401c017a
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1401c016a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x1401c01c2
cmp qword [rbx + 0x10], 0
jne 0x1401c01ae
mov rcx, qword [rcx + 0x10]
lea rdx, [0x1401d8fe8]
call fcn.14016c228
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401c01ae
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.14016cb68
mov rdi, rax
test rax, rax
jne 0x1401c01e5
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1401c01dc
call fcn.14016b92c
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1401c3410
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [fcn.14016d5e4]
mov rdi, rax
test rax, rax
jne 0x1401c3451
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x1401c3495
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x1401c34f4
mov rsi, r12
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
dec r12
jne 0x1401c34b0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401c3533
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140239019]
mov r8d, 1
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14023901a]
mov r8d, 1
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1401c3500
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret

Function at 0x1401c4630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x1401c465a
call fcn.14016dcb8
and dword [rax], 0
call fcn.14016dc98
mov ebx, reloc.WLDAP32.dll_Ordinal_22
mov dword [rax], ebx
call fcn.140173fb8
mov eax, ebx
jmp 0x1401c46aa
test edx, 0xfffffff9
jne 0x1401c463d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401c4683
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14016dcd8
call fcn.14016dc98
mov eax, dword [rax]
jmp 0x1401c46aa
test al, 0x10
jne 0x1401c46a8
test al, 1
je 0x1401c46a8
test bl, 2
je 0x1401c46a8
call fcn.14016dcb8
mov dword [rax], 5
call fcn.14016dc98
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x1401c467a
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400111ea
Capabilities:
Terminate process

Disassembly:
jmp 0x140012e30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011271
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014180
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400141a0
xor al, al
jmp 0x140014221
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400141b3
xor al, al
jmp 0x140014221
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400141dd
xor al, al
jmp 0x140014221
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400141f1
xor al, al
jmp 0x140014221
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014203
xor al, al
jmp 0x140014221
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001421f
xor al, al
jmp 0x140014221
mov al, 1
add rsp, 0x38
ret
Function at 0x140003a00
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1400b9560], 0
je 0x14001bd06
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call sym.spoolsv.exe_PrvRevertToPrinterSelf
xor edx, edx
lea r8, str.RouterPreInitEvent
mov rdi, rax
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14001bd9c
mov rax, qword [0x1400b72f8]
lea rcx, [0x1400b72f8]
cmp rax, rcx
je 0x14001bd70
test byte [rax + 0x44], 0x20
je 0x14001bd70
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400b72f8]
lea edx, [rbx + 0x15]
mov r9d, eax
lea r8, [0x14009ca70]
mov rcx, qword [rcx + 0x38]
call fcn.1400305f8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rcx, [0x14009b6d8]
mov edx, eax
call fcn.1400531a8
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test rdi, rdi
je 0x14001bde3
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x14001bde3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
mov ecx, 0x69
call fcn.140052da0
or edx, 0xffffffff
call fcn.14005835c
nop
jmp 0x140003a17
Function at 0x140009ff0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140029f2f
cmp dword [rcx], 0x6060
jne 0x140029f2f
mov rax, qword [0x1400b9558]
cmp qword [rcx + 8], rax
jne 0x140029ea6
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax + 0x2b0]
call qword [0x140098d58]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x140029f25
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
or qword [rbx + 0x38], 0xffffffffffffffff
cmp qword [rbx + 0x40], 0
je 0x140029f25
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rcx, qword [rbx + 0x40]
mov rdi, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140029efa
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
test rdi, rdi
je 0x140029f07
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400b9518]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
and qword [rbx + 0x40], 0
mov eax, 1
jmp 0x14000a034
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x14000a034
Function at 0x14000bf48
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400b77a8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebp, ebp
mov rsi, rcx
mov qword [rsp + 0x38], rbp
mov ebx, ebp
test rcx, rcx
je 0x14000c0b4
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x14000bf8a
inc rax
cmp rax, 0x207
jae 0x14000c0b4
mov ecx, 0x438
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
je 0x14000c0b4
lea rcx, [rsp + 0x40]
call fcn.14000c218
lea r8, str.PrintersConnections
mov edx, 0x21c
mov rcx, rdi
call fcn.14000c1d0
mov eax, 0x5c
lea rdx, [rdi + 0x2a]
mov r8d, 0x207
mov word [rdi + 0x28], ax
mov rcx, rsi
call sym.spoolsv.exe_PrvFormatPrinterForRegistryKey
mov ecx, 0x20019
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov rsi, rax
test rax, rax
je 0x14000c092
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c083
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14009a990]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14002a186
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [0x1400b9518]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.14000c0e8
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400133c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rbx, qword [0x1400b9558]
jmp 0x14002a1af
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000c072
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14002a18f
jmp 0x14000c072

Function at 0x14000c0e8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx]
mov rbx, rcx
cmp rdx, 0xffffffffffffffff
je 0x14000c115
test rdx, rdx
je 0x14000c115
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x14002a1ba
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000c580
mov ecx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
Function at 0x14000cdac
Capabilities:
Delete file
Move file

Disassembly:
test rcx, rcx
je 0x14000ce46
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1400b9258]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
test rax, rax
jne 0x14002aeba
or edx, 0xffffffff
mov rcx, rbx
call fcn.14000ce6c
lea rcx, [rbx + 0x18]
cmp qword [rcx], 0
jne 0x14000ce5f
lea rcx, [0x1400b9258]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
jne 0x14002aec8
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x14002aeda
mov r8, qword [rbx + 0x48]
test r8, r8
jne 0x14000ce48
mov rcx, qword [0x1400b9518]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x1400b9518]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
jmp 0x14000ce29
call fcn.140009024
jmp 0x14000cdf2
and qword [rax + 8], 0
mov rax, qword [rax + 0x10]
jmp 0x14000cdd4
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x14000ce13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14002af00
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400b9518]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
and qword [rbx + 0x40], 0
jmp 0x14000ce20
Function at 0x14000d9e0
Capabilities:
Get thread local storage value
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400b77a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [0x1400b9550]
xor esi, esi
mov edi, eax
cmp ecx, 0xffffffff
je 0x14002cb1a
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqTransportType]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000db6b
cmp dword [rsp + 0x60], 4
jne 0x14002cb38
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
mov ebx, 1
lea r9, [rsp + 0x70]
mov rcx, rax
mov r8d, ebx
lea edx, [rbx + 7]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x14000db7a
lea rax, [rsp + 0x68]
mov dword [rsp + 0x78], esi
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 1]
mov dword [rsp + 0x48], esi
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
movzx edx, bl
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x7c], 0x500
mov qword [rsp + 0x68], rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x14002cb4e
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x64]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x14002cb42
cmp dword [rsp + 0x64], esi
jne 0x14000db0b
mov ebx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test ebx, ebx
js 0x14002cb5a
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400133c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
cmp eax, 0x6bd
jne 0x14002cb22
mov ebx, esi
jmp 0x14000db2d
call fcn.14000dcb4
mov ebx, eax
cmp eax, 0x800703f0
je 0x14000db76
jmp 0x14000db2d
mov rax, rsi
jmp 0x14000da2f
test eax, eax
jle 0x14000db2d
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000db2d
mov ebx, 1
jmp 0x14000db2d
call fcn.14000dcb4
mov ebx, eax
jmp 0x14000db0b
call fcn.14000dcb4
mov ebx, eax
jmp 0x14000db1c
mov rcx, qword [0x1400b72f8]
lea rax, [0x1400b72f8]
cmp rcx, rax
je 0x14000db43
test byte [rcx + 0x44], 0x20
je 0x14000db43
mov rcx, qword [rcx + 0x38]
lea r8, [0x14009cb48]
mov edx, 0x12
mov r9d, ebx
call fcn.1400305f8
nop
jmp 0x14000db43
Function at 0x14000e000
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ecx, 0x440
xor edi, edi
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rbx, rax
test rax, rax
je 0x14000e093
mov ecx, 0x2001f
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov qword [rbx + 8], rax
test rax, rax
je 0x14002a7d9
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
mov r9, rbx
lea edx, [rdi + 0xe]
mov rcx, rax
lea r8d, [rdi + 1]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x14002a7d0
test rbx, rbx
je 0x14000e080
cmp dword [0x1400b9560], edi
je 0x14002a7f9
mov rcx, rbx
call fcn.14000e950
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
jmp 0x14000e082
lea rcx, [rbx + 8]
call fcn.14000eb18
mov rcx, qword [0x1400b9518]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rbx, rdi
jmp 0x14000e067
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [fcn.14000e950]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
test rax, rax
je 0x14002a83b
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x14000e080
mov rcx, qword [rbx]
mov edi, 1
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
lea rcx, [rbx + 8]
call fcn.14000eb18
mov rcx, qword [0x1400b9518]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
nop
jmp 0x14000e080
Function at 0x14000e564
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
xor edi, edi
lea rcx, [rbp - 0x50]
mov qword [rbp + 0x30], rdi
mov rsi, rdx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rax, [rbp - 0x50]
mov dword [rbp - 0x30], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r9d, [rdi + 8]
mov qword [rbp - 0x28], rbx
lea r8, [rbp - 0x30]
mov dword [rbp - 0x18], 0x140
mov edx, 0x2000000
lea rcx, [rbp + 0x30]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKeyEx]
nop dword [rax + rax]
test eax, eax
js 0x14000e62b
lea rdx, str.SymbolicLinkValue
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r8d, [rdi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
cmp eax, 0xc0000034
jne 0x14000e641
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xa8]
mov eax, edi
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
cmp dword [rbp + 0x20], edi
jbe 0x14000e61b
jmp 0x14002aa1e
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
test eax, eax
mov ecx, 1
cmovns edi, ecx
mov rcx, qword [0x1400b72f8]
lea rax, [0x1400b72f8]
cmp rcx, rax
je 0x14000e61b
test byte [rcx + 0x44], 0x20
je 0x14000e61b
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400ac570]
mov edx, 0xa
mov r9, rsi
call fcn.140040cf0
nop
jmp 0x14000e61b
Function at 0x14000e950
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400b77a8]
xor rax, rsp
mov qword [rbp - 8], rax
and dword [rbp - 0x1c], 0
lea rdi, [rcx + 8]
and qword [rbp - 0x18], 0
lea rdx, str.Printers
mov rbx, rcx
mov rcx, qword [rdi]
call fcn.14000e564
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x18]
mov rcx, qword [rdi]
lea rdx, str.Printers
mov qword [rsp + 0x38], rax
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov dword [rbp - 0x20], eax
test eax, eax
jne 0x14002b20c
mov rcx, qword [rbp - 0x18]
call fcn.14000e09c
mov dword [rbp - 0x20], eax
test eax, eax
jne 0x14002b20c
lea rcx, [rbp - 0x18]
call fcn.140012d28
cmp dword [0x1400b9560], 0
je 0x14002b24b
mov rcx, qword [rbx]
call fcn.14000ff6c
test eax, eax
jne 0x14000eac7
mov rdx, rdi
xor ecx, ecx
call fcn.14000e2dc
test eax, eax
je 0x14000ea74
mov edx, 1
mov rcx, rdi
call fcn.14000eb94
mov rcx, qword [rbx]
lea rax, [rbp - 0x10]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
xor eax, eax
mov dword [rbp - 0x10], eax
call fcn.140010630
test eax, eax
js 0x14000ea67
lea rdx, str._Classes
lea rcx, [rbp - 0x18]
call fcn.140010a30
test eax, eax
js 0x14000ea67
mov rcx, qword [rbp - 0x18]
call fcn.14000f508
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x18]
call fcn.140010c30
and qword [rsp + 0x20], 0
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 3]
call sym.spoolsv.exe_PrvRouterBroadcastMessage
mov rcx, qword [rbx]
lea rax, [rbp - 0x20]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x1c]
lea edx, [r9 + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x14000eac7
mov r8d, dword [rbp - 0x1c]
mov edx, 1
mov ecx, edx
mov r9, rbx
call fcn.14000c6cc
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14002b268
mov rcx, rdi
call fcn.14000eb18
mov rcx, qword [0x1400b9518]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400133c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov rcx, qword [0x1400b72f8]
lea rdx, [0x1400b72f8]
cmp rcx, rdx
je 0x14000e9ec
test byte [rcx + 0x44], 0x20
je 0x14000e9ec
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400ac570]
mov edx, 0xd
mov r9d, eax
call fcn.1400305f8
nop
jmp 0x14000e9ec
mov edx, 0x1d4c0
call fcn.14005835c
test eax, eax
jns 0x14000ea02
call sym.spoolsv.exe_PrvWaitForSpoolerInitialization
nop
jmp 0x14000ea02
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x14000ead3