joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008180
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r8, qword [0x140021120]
mov rbx, 0xffffffffffffffff
mov rax, rbx
mov rsi, rdx
mov rbp, rcx
nop dword [rax + rax]
inc rax
cmp byte [r8 + rax], 0
jne 0x1400081c0
add rax, 9
xor edi, edi
cmp rax, 0x100
jae 0x140008250
mov ecx, edi
lea rdx, str.Software
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
mov byte [rsp + rcx + 0x60], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400081f0
lea rcx, [rsp + 0x60]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140008210
movzx eax, word [0x140021274]
mov word [rcx], ax
lea rcx, [rsp + 0x60]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140008230
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008240
lea rax, [rsp + 0x50]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400082c0
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea r9, [0x14002122b]
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test eax, eax
jne 0x1400082f8
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400082c0
mov rcx, qword [rsp + 0x50]
inc ebx
mov dword [rsp + 0x28], ebx
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg edi
sbb eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400085c0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008ed8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax]
mov qword [rsp + 0x28], rax
jmp 0x14000a41c
mov edx, eax
mov rcx, qword [rsp + 0x88]
call fcn.14000b3b7
jmp 0x14000a654
cmp qword [rsp + 0x30], 0
je 0x14000af76
jmp 0x140008ddb
cmp qword [rsp + 0x30], 0
jne 0x14000c120
jmp 0x14000c6f1
cmp qword [rsp + 0x28], 0
je 0x140009398
jmp 0x14000f2d3
cmp qword [rsp + 0x40], rax
jne 0x14000bb86
jmp 0x1400090db
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
call qword [0x140086647]
mov qword [rsp + 0x28], rax
jmp 0x14000a41c
mov ecx, 0xc1
call qword [0x140087179]
xor eax, eax
jmp 0x14000c638
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call qword [rax]
mov qword [rsp + 0x28], rax
jmp 0x14000dadc
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [0x140087d6c]
mov qword [rsp + 0x28], rax
jmp 0x14000dadc
mov ecx, 0xe
call qword [0x140088788]
xor eax, eax
jmp 0x14000c638
cmp qword [rsp + 0x28], 0
je 0x14000d253
jmp 0x14000f2d3
Function at 0x140009e57
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov word [rsp + 0x316], ax
mov eax, 0x65
mov word [rsp + 0x318], ax
mov eax, 0x6c
mov word [rsp + 0x31a], ax
mov eax, 0x33
mov word [rsp + 0x31c], ax
mov eax, 0x32
jmp 0x14000c90e
mov word [rsp + 0x326], ax
xor eax, eax
mov word [rsp + 0x328], ax
mov eax, 0x75
mov word [rsp + 0x2d8], ax
mov eax, 0x73
mov word [rsp + 0x2da], ax
mov eax, 0x65
jmp 0x14000a6ef
sub rsp, 0x428
mov eax, 0x6b
mov word [rsp + 0x310], ax
mov eax, 0x65
mov word [rsp + 0x312], ax
mov eax, 0x72
mov word [rsp + 0x314], ax
mov eax, 0x6e
jmp 0x140009ce6
mov word [rsp + 0x2dc], ax
mov eax, 0x72
mov word [rsp + 0x2de], ax
mov eax, 0x33
mov word [rsp + 0x2e0], ax
mov eax, 0x32
mov word [rsp + 0x2e2], ax
mov eax, 0x2e
jmp 0x14000c42d
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x2d8]
call fcn.14000d66f
jmp 0x14000f545
mov byte [rsp + 0x13e], 0x6c
mov byte [rsp + 0x13f], 0x41
mov byte [rsp + 0x140], 0x6c
mov byte [rsp + 0x141], 0x6c
mov byte [rsp + 0x142], 0x6f
mov byte [rsp + 0x143], 0x63
mov byte [rsp + 0x144], 0
jmp 0x14000ec57
mov word [rsp + 0x306], ax
xor eax, eax
mov word [rsp + 0x308], ax
lea rcx, [rsp + 0x310]
call fcn.14000d66f
jmp 0x14000ac29
mov word [rsp + 0x2fe], ax
mov eax, 0x2e
mov word [rsp + 0x300], ax
mov eax, 0x64
mov word [rsp + 0x302], ax
mov eax, 0x6c
mov word [rsp + 0x304], ax
mov eax, 0x6c
jmp 0x14000b639
mov qword [rsp + 0x2d0], rax
mov byte [rsp + 0x138], 0x56
mov byte [rsp + 0x139], 0x69
mov byte [rsp + 0x13a], 0x72
mov byte [rsp + 0x13b], 0x74
mov byte [rsp + 0x13c], 0x75
mov byte [rsp + 0x13d], 0x61
jmp 0x14000b36a
mov word [rsp + 0x2e4], ax
mov eax, 0x64
mov word [rsp + 0x2e6], ax
mov eax, 0x6c
mov word [rsp + 0x2e8], ax
mov eax, 0x6c
mov word [rsp + 0x2ea], ax
xor eax, eax
jmp 0x14000cebd
mov word [rsp + 0x2f6], ax
mov eax, 0x70
mov word [rsp + 0x2f8], ax
mov eax, 0x69
mov word [rsp + 0x2fa], ax
mov eax, 0x33
mov word [rsp + 0x2fc], ax
mov eax, 0x32
jmp 0x14000b98d
mov word [rsp + 0x31e], ax
mov eax, 0x2e
mov word [rsp + 0x320], ax
mov eax, 0x64
mov word [rsp + 0x322], ax
mov eax, 0x6c
mov word [rsp + 0x324], ax
mov eax, 0x6c
jmp 0x140009d41
mov word [rsp + 0x2ec], ax
mov eax, 0x61
mov word [rsp + 0x2f0], ax
mov eax, 0x64
mov word [rsp + 0x2f2], ax
mov eax, 0x76
mov word [rsp + 0x2f4], ax
mov eax, 0x61
jmp 0x14000c573
mov byte [rsp + 0xb8], 0x56
mov byte [rsp + 0xb9], 0x69
mov byte [rsp + 0xba], 0x72
mov byte [rsp + 0xbb], 0x74
mov byte [rsp + 0xbc], 0x75
mov byte [rsp + 0xbd], 0x61
mov byte [rsp + 0xbe], 0x6c
jmp 0x14000f5d3
mov byte [rsp + 0x17a], 0x72
mov byte [rsp + 0x17b], 0x74
mov byte [rsp + 0x17c], 0x75
mov byte [rsp + 0x17d], 0x61
mov byte [rsp + 0x17e], 0x6c
mov byte [rsp + 0x17f], 0x50
mov byte [rsp + 0x180], 0x72
jmp fcn.140008c88
mov qword [rsp + 0x338], rax
lea rcx, [rsp + 0x2f0]
call fcn.14000d66f
jmp 0x14000c216
mov byte [rsp + 0xbf], 0x46
mov byte [rsp + 0xc0], 0x72
mov byte [rsp + 0xc1], 0x65
mov byte [rsp + 0xc2], 0x65
mov byte [rsp + 0xc3], 0
mov byte [rsp + 0x178], 0x56
mov byte [rsp + 0x179], 0x69
jmp 0x14000ef66
Function at 0x14000b2c6
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
add byte [rax - 0x75], cl
xor byte [rax - 0x77], cl
and al, 0x40
and al, 0x40
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x140008e4d

Function at 0x14000b564
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x24], 0
jmp 0x14000d1c2
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x24], eax
jb 0x14000f321
jmp 0x14000dfb7
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x14000c0e9
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x1a0]
jmp 0x14000a36c
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
jmp 0x14000bc2b
jmp 0x14000b1a9
Function at 0x14000d66f
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x140009b27
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
je 0x14000eeeb
jmp 0x14000ea5b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x14000ea5b
jmp 0x14000eeeb
test eax, eax
je 0x14000ab2d
jmp 0x14000b966
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000da81
jmp 0x14000b966
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x14000bb9d
jmp 0x140009b27
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
je 0x14000bb9d
jmp 0x14000aa44
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x14000d8b3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x14000aa44
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x140009254
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
jne 0x14000b31f
jmp 0x1400088ea
mov rcx, qword [rsp + 0x70]
call fcn.1400091d4
jmp 0x14000f275
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.14000ae1c
jmp 0x14000a5a9
Function at 0x140001f30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140008090
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140008090
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x140001fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x14000e0c4]
mov r12, rcx
test ebx, ebx
jle 0x1400020d0
mov rax, qword [0x14000e0c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x140001fec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140002073
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x140001fd0
mov rcx, r12
call fcn.140002950
mov rsi, rax
test rax, rax
je 0x1400020f2
mov rax, qword [0x14000e0c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140002a80
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14000e0c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400020d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000206c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002080
add dword [0x14000e0c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x14000e0c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000206c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001f30
nop dword [rax]
xor ebx, ebx
jmp 0x140001ff7
mov rax, qword [0x14000e0c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001f30
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140001f30
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400025c0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14000e120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000e100]
test rbx, rbx
je 0x140002614
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000260b
test r12, r12
je 0x14000260b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400025f0
lea rcx, [0x14000e120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002950
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a960]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002970
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002978
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002970
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400029c5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400029bc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002970
add rax, 0x28
cmp rax, r9
jne 0x1400029a8
xor eax, eax
ret

Function at 0x1400029d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a960]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400029f0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400029f8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400029f0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140002a80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a960]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002aa0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002aa8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x100001c2c
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x90
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov eax, dword [0x10000f544]
xor r12d, r12d
lea ebx, [r12 + 2]
mov byte [r11 - 0x20], r12b
mov byte [r11 - 0x1f], r12b
cmp eax, ebx
mov byte [r11 - 0x1e], r12b
mov byte [r11 - 0x1d], r12b
mov byte [r11 - 0x1c], r12b
mov dword [r11 - 0x38], r12d
mov byte [rsp + 0x7d], 5
jne 0x100001df8
lea rcx, [r11 - 0x38]
call fcn.100001b18
cmp eax, r12d
jne 0x100001ddd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
lea edx, [rbx + 6]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r12d
jne 0x100001cc2
xor eax, eax
jmp 0x100001df8
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r12d
jne 0x100001dcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100001dcc
mov edx, dword [rsp + 0x64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp rax, r12
mov rdi, rax
je 0x100001dcc
mov r9d, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r12d
je 0x100001dc3
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov r8d, 0x20
mov dl, bl
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r12d
je 0x100001dc3
cmp dword [rdi], r12d
mov esi, r12d
jbe 0x100001db8
lea rbp, [rdi + 8]
mov ebx, 1
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, r12d
jne 0x100001dae
add esi, ebx
add rbp, 0x10
cmp esi, dword [rdi]
jb 0x100001d8e
jmp 0x100001db8
mov dword [0x10000f544], ebx
mov dword [rsp + 0x60], ebx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x60]
jmp 0x100001df8
mov ecx, dword [0x10000f544]
mov eax, dword [rsp + 0x60]
mov ebx, 1
cmp eax, r12d
cmovne ecx, ebx
mov dword [0x10000f544], ecx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x100002568
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
test eax, eax
jne 0x1000025b0
and dword [rsp + 0x28], eax
xor r9d, r9d
mov edx, 0x4f5
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
call fcn.100005554
xor eax, eax
jmp 0x100002633
lea r8, [rsp + 0x34]
lea rdx, [0x100001648]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x100002618
mov edx, 0x4f6
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
jmp 0x10000259c
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x10000262e
mov edx, 0x4f7
jmp 0x100002609
mov eax, 1
add rsp, 0x40
pop rbx
ret
Function at 0x10000290c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
test rcx, rcx
je 0x100002af8
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x100002ad4
lea rax, [r11 - 0x128]
mov r9d, 0x104
mov rdi, rbx
sub rdi, rax
mov rdx, r9
lea rcx, [r11 - 0x128]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x100002982
mov al, byte [rdi + rcx]
test al, al
je 0x100002982
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x100002963
test rdx, rdx
jne 0x10000298b
sub rcx, 1
mov byte [rcx], 0
lea r8, [0x100001680]
lea rcx, [rsp + 0x160]
mov rdx, r9
call fcn.100001a08
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x100002ad4
mov r8d, 0x104
lea rdx, [rsp + 0x160]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x1000029f2
mov al, byte [rdi + rdx]
test al, al
je 0x1000029f2
mov byte [rdx], al
add rdx, 1
sub r8, 1
jne 0x1000029d3
test r8, r8
jne 0x1000029fb
sub rdx, 1
test byte [rsp + 0x20], 0x10
mov byte [rdx], 0
je 0x100002a74
lea rdx, [0x100001684]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100002aac
lea rdx, [0x100001688]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100002aac
lea r8, [rsp + 0x4c]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call fcn.100001a08
lea r8, [0x1000015b9]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call fcn.100007fa4
lea rcx, [rsp + 0x160]
call fcn.10000290c
jmp 0x100002aac
lea r8, [rsp + 0x4c]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call fcn.100001a08
lea rcx, [rsp + 0x160]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000029c5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100002915
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
test rcx, rcx
je 0x100002af8
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x100002ad4
lea rax, [r11 - 0x128]
mov r9d, 0x104
mov rdi, rbx
sub rdi, rax
mov rdx, r9
lea rcx, [r11 - 0x128]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x100002982
mov al, byte [rdi + rcx]
test al, al
je 0x100002982
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x100002963
test rdx, rdx
jne 0x10000298b
sub rcx, 1
mov byte [rcx], 0
lea r8, [0x100001680]
lea rcx, [rsp + 0x160]
mov rdx, r9
call fcn.100001a08
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x100002ad4
mov r8d, 0x104
lea rdx, [rsp + 0x160]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x1000029f2
mov al, byte [rdi + rdx]
test al, al
je 0x1000029f2
mov byte [rdx], al
add rdx, 1
sub r8, 1
jne 0x1000029d3
test r8, r8
jne 0x1000029fb
sub rdx, 1
test byte [rsp + 0x20], 0x10
mov byte [rdx], 0
je 0x100002a74
lea rdx, [0x100001684]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100002aac
lea rdx, [0x100001688]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100002aac
lea r8, [rsp + 0x4c]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call fcn.100001a08
lea r8, [0x1000015b9]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call fcn.100007fa4
lea rcx, [rsp + 0x160]
call fcn.10000290c
jmp 0x100002aac
lea r8, [rsp + 0x4c]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call fcn.100001a08
lea rcx, [rsp + 0x160]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000029c5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret