joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180050804
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, rdx
mov esi, ecx
lea edx, [rbx + 0x10]
lea ecx, [rbx + 0x40]
mov rdi, r9
mov ebp, r8d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x180050972
mov dword [rax], esi
test esi, esi
je 0x18005096d
dec esi
jne 0x180050962
lea edx, [rbx + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov rax, qword [rdi]
mov qword [rax + 8], rcx
mov rax, qword [rdi]
cmp qword [rax + 8], rbx
je 0x180050962
mov eax, ebp
mov rcx, r14
mov qword [rsp + 0x28], rbx
neg eax
mov dword [rsp + 0x20], ebx
sbb r8d, r8d
xor r9d, r9d
xor edx, edx
and r8d, 2
add r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx], rdx
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
cmp qword [rcx], rbx
je 0x180050962
mov rcx, qword [rcx]
neg ebp
mov qword [rsp + 0x20], rbx
sbb edx, edx
xor r9d, r9d
xor r8d, r8d
and edx, 0xfffffffe
add edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 8], rdx
mov rax, qword [rdi]
mov rdx, qword [rax + 8]
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x180050962
cmp dword [rcx], 0x66676572
jne 0x180050948
cmp dword [rcx + 0x1c], ebx
jne 0x180050948
add rcx, 0x1000
cmp dword [rcx], 0x6e696268
jne 0x180050948
mov qword [rdx + 0x10], rcx
movsxd rax, dword [rcx + 4]
lea rdx, [rcx + 0x20]
add rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 0x18], rdx
mov rax, qword [rdi]
mov ecx, 0x6b6e
mov rdx, qword [rax + 8]
mov rax, qword [rdx + 0x18]
cmp word [rax + 4], cx
jne 0x180050948
test byte [rax + 6], 0xc
jne 0x18005096d
mov rcx, qword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180050972
mov ebx, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r14
ret
Function at 0x180050bd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov r10d, dword [rcx]
xor ebx, ebx
mov rsi, r9
mov r11, r8
mov rdi, rdx
mov r14, rcx
test r10d, r10d
je 0x180050c84
dec r10d
jne 0x180050cbd
call fcn.1800516dc
test rax, rax
mov rcx, rax
setne bl
test ebx, ebx
je 0x180050cbd
mov edi, dword [rax + 8]
mov rdx, qword [rsp + 0x60]
btr edi, 0x1f
test rdx, rdx
je 0x180050c34
mov eax, dword [rax + 0x10]
mov dword [rdx], eax
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x180050cbd
mov r9, qword [rsp + 0x68]
test r9, r9
je 0x180050c80
xor ebx, ebx
cmp dword [rsi], edi
setae bl
test ebx, ebx
je 0x180050c80
test dword [rcx + 8], 0x80000000
je 0x180050c62
lea rdx, [rcx + 0xc]
jmp 0x180050c75
mov rax, qword [r14 + 8]
movsxd r8, dword [rcx + 0xc]
mov rdx, qword [rax + 0x10]
add rdx, 4
add rdx, r8
mov r8d, edi
mov rcx, r9
call fcn.1800ca790
mov dword [rsi], edi
jmp 0x180050cbd
mov rax, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
mov r8, rsi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov rdx, r11
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x180050cbd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r14
ret

Function at 0x180050cdc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10d, dword [rcx]
xor ebx, ebx
mov ebp, r9d
mov r11, r8
mov rsi, rdx
mov rdi, rcx
test r10d, r10d
je 0x180050d7c
dec r10d
jne 0x180050db3
call fcn.1800516dc
mov rcx, rax
test rax, rax
je 0x180050db3
mov edx, dword [rax + 8]
mov r8d, edx
btr r8d, 0x1f
cmp r8d, dword [rsp + 0x70]
setae bl
test ebx, ebx
je 0x180050d75
mov eax, dword [rsp + 0x60]
mov dword [rcx + 0x10], eax
mov eax, 0x80000000
and edx, eax
or edx, dword [rsp + 0x70]
mov dword [rcx + 8], edx
test eax, edx
je 0x180050d56
add rcx, 0xc
jmp 0x180050d69
movsxd rdx, dword [rcx + 0xc]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x10]
add rcx, 4
add rcx, rdx
mov rdx, qword [rsp + 0x68]
call fcn.1800ca790
jmp 0x180050db3
mov ecx, Ordinal_54
jmp 0x180050dad
mov eax, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x60]
mov r8d, ebp
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov rdx, r11
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x180050db3
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180050fc8
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
mov r10, rdx
mov edx, dword [rcx]
mov r15, r9
mov r11d, r8d
mov r13, rcx
mov ebx, ebp
test edx, edx
je 0x180051174
dec edx
jne 0x1800511d0
cmp dword [r10 + 0x18], ebp
je 0x1800511d0
cmp r11d, dword [r10 + 0x18]
jae 0x1800511d0
cmp dword [r10 + 0x20], 0xffffffff
je 0x1800511d0
mov rax, qword [rcx + 8]
movsxd rcx, dword [r10 + 0x20]
mov rdx, qword [rax + 0x10]
add rcx, rdx
movzx eax, word [rcx + 4]
add eax, 0xffff9994
test eax, 0xfffffdff
jne 0x1800511d0
cmp word [rcx + 6], bp
je 0x1800511d0
movzx eax, word [rcx + 6]
cmp r11d, eax
jae 0x1800511d0
movsxd rsi, dword [rcx + r11*8 + 8]
mov eax, 0x6b6e
add rsi, rdx
cmp word [rsi + 4], ax
jne 0x1800511d0
test r9, r9
je 0x1800511d0
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x1800511d0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1800510a4
mov rax, qword [r10 + 8]
mov qword [rcx], rax
test byte [rsi + 6], 0x20
je 0x18005114e
movzx edi, word [rsi + 0x4c]
cmp dword [r14], edi
seta bl
test ebx, ebx
je 0x1800510ee
lea rcx, [rsi + 0x50]
mov edx, edi
call fcn.180052f30
mov rbp, rax
test rax, rax
je 0x1800510e7
lea r8, [rdi + rdi]
mov rdx, rax
mov rcx, r15
call fcn.1800ca790
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov word [r15 + rdi*2], bp
mov dword [r14], edi
mov r14, qword [rsp + 0xa8]
test r14, r14
je 0x1800511d0
movzx eax, word [rsi + 0x4e]
mov r15, qword [rsp + 0xa0]
mov edi, eax
shr edi, 1
test r15, r15
je 0x180051146
cmp dword [r14], edi
mov ebx, ebp
seta bl
test ebx, ebx
je 0x180051146
movsxd rdx, dword [rsi + 0x34]
mov r8d, eax
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 0x10]
add rcx, 4
add rdx, rcx
mov rcx, r15
call fcn.1800ca790
mov word [r15 + rdi*2], bp
mov dword [r14], edi
jmp 0x1800511d0
movzx edi, word [rsi + 0x4c]
shr edi, 1
cmp dword [r14], edi
seta bl
test ebx, ebx
je 0x1800510ee
movzx r8d, word [r10 + 0x4c]
lea rdx, [rsi + 0x50]
mov rcx, r9
call fcn.1800ca790
jmp 0x1800510e9
mov rax, qword [rsp + 0xb0]
mov r9, qword [rsp + 0x90]
mov r8, r15
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov edx, r11d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov rcx, r10
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x1800511d0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800511f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r10, rdx
mov edx, dword [rcx]
mov r12, r9
mov r11d, r8d
mov r15, rcx
mov edi, r13d
test edx, edx
je 0x1800513c0
dec edx
jne 0x18005141d
test r10, r10
jne 0x180051245
mov rax, qword [rcx + 8]
mov r10, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [r10 + 4], ax
jne 0x18005141d
cmp dword [r10 + 0x28], r13d
je 0x18005141d
cmp r11d, dword [r10 + 0x28]
jae 0x18005141d
cmp dword [r10 + 0x2c], 0xffffffff
je 0x18005141d
mov rax, qword [rcx + 8]
movsxd rcx, dword [r10 + 0x2c]
add rcx, qword [rax + 0x10]
movsxd rbx, dword [rcx + r11*4 + 4]
add rbx, qword [rax + 0x10]
mov eax, 0x6b76
cmp word [rbx + 4], ax
jne 0x18005141d
test r9, r9
je 0x18005141d
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x18005141d
movzx eax, word [rbx + 6]
test ax, ax
je 0x180051341
test byte [rbx + 0x14], 1
movzx esi, ax
movzx edx, ax
je 0x1800512db
lea rcx, [rbx + 0x18]
inc esi
call fcn.180052f30
mov rbp, rax
jmp 0x18005130b
shr esi, 1
add rdx, 2
mov ecx, 0x40
inc esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x18005141d
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.1800ca790
test rbp, rbp
je 0x18005141d
cmp dword [r14], esi
setae dil
test edi, edi
je 0x180051336
mov r8d, esi
mov rdx, rbp
mov rcx, r12
add r8, r8
call fcn.1800ca790
lea eax, [rsi - 1]
mov dword [r14], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180051344
mov dword [r14], r13d
test edi, edi
je 0x18005141d
mov esi, dword [rbx + 8]
mov rcx, qword [rsp + 0xa0]
btr esi, 0x1f
test rcx, rcx
je 0x180051365
mov eax, dword [rbx + 0x10]
mov dword [rcx], eax
mov r14, qword [rsp + 0xb0]
test r14, r14
je 0x18005141d
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x1800513bb
cmp dword [r14], esi
mov edi, r13d
setae dil
test edi, edi
je 0x1800513bb
test dword [rbx + 8], 0x80000000
je 0x1800513a0
lea rdx, [rbx + 0xc]
jmp 0x1800513b3
mov rax, qword [r15 + 8]
movsxd r8, dword [rbx + 0xc]
mov rdx, qword [rax + 0x10]
add rdx, 4
add rdx, r8
mov r8d, esi
call fcn.1800ca790
mov dword [r14], esi
jmp 0x18005141d
mov rax, qword [rsp + 0xb0]
mov r9, qword [rsp + 0x90]
mov r8, r12
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov edx, r11d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov rcx, r10
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
sete dil
test edi, edi
jne 0x18005141d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180051e14
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, str.ServicesActive
lea r8d, [rbx + 1]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x180051e93
lea r8d, [rbx + 4]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x180051e8a
lea rax, [rsp + 0x50]
lea r9d, [rbx + 0x24]
mov r8, rbp
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180051f34
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
lea rdx, str.ServicesActive
lea r8d, [rbx + 1]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x180051f9a
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x180051f91
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180052238
Capabilities:
Create service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov r15, r8
mov r12, rdx
mov rbx, rcx
xor esi, esi
lea rdx, str.ServicesActive
xor ecx, ecx
lea r8d, [rsi + 3]
mov r14d, r9d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x1800523ee
lea r8d, [rsi + 0x10]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1800522ae
lea rcx, str.____s_service_already_registered_n
mov rdx, rbx
call fcn.18004d68c
jmp 0x18005237c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x180052368
lea rcx, str.____s_service_not_present_n
mov rdx, rbx
call fcn.18004d68c
and qword [rsp + 0x60], rsi
and qword [rsp + 0x58], rsi
and qword [rsp + 0x50], rsi
and qword [rsp + 0x48], rsi
and qword [rsp + 0x40], rsi
mov eax, dword [rsp + 0xb0]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], eax
mov r9d, 0x60010
mov r8, r12
mov rdx, rbx
mov rcx, rbp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x180052359
lea rcx, str.____s_service_successfully_registered_n
mov rdx, rbx
call fcn.18004d68c
mov rcx, rdi
call fcn.1800520d0
mov esi, eax
test eax, eax
je 0x18005234a
lea rcx, str.____s_service_ACL_to_everyone_n
jmp 0x1800522a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___kull_m_service_addWorldToSD__0x_08x__n
jmp 0x180052375
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___CreateService__0x_08x__n
jmp 0x180052375
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___OpenService__0x_08x__n
mov edx, eax
call fcn.18004d68c
test rdi, rdi
je 0x1800523e3
cmp dword [rsp + 0xb8], 0
je 0x1800523da
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, eax
test eax, eax
je 0x1800523a8
lea rcx, str.____s_service_started_n
jmp 0x1800523bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x1800523c6
lea rcx, str.____s_service_already_started_n
mov rdx, rbx
call fcn.18004d68c
jmp 0x1800523da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___StartService__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180052402
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___OpenSCManager_create___0x_08x__n
mov edx, eax
call fcn.18004d68c
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180053a74
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, r8
mov rbx, rdx
and qword [rax - 0x18], rdi
and qword [rdx], rdi
and qword [rax - 0x20], rdi
and dword [r8], edi
mov qword [rax - 0x28], r8
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov rbp, rcx
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x180053afe
mov edx, dword [rsi]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180053afe
and qword [rsp + 0x30], rdi
and qword [rsp + 0x28], rdi
lea r8d, [rdi + 1]
mov r9, rax
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov edi, eax
test eax, eax
jne 0x180053afe
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x40
pop rdi
ret

Function at 0x180053b1c
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, r8
mov rbx, rdx
and qword [rax - 0x18], rdi
and qword [rdx], rdi
and qword [rax - 0x20], rdi
and dword [r8], edi
mov qword [rax - 0x28], r8
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov rbp, rcx
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x180053ba6
mov edx, dword [rsi]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180053ba6
and qword [rsp + 0x30], rdi
and qword [rsp + 0x28], rdi
lea r8d, [rdi + 1]
mov r9, rax
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov edi, eax
test eax, eax
jne 0x180053ba6
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x40
pop rdi
ret

Function at 0x180053d60
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [rax + 0x20]
mov rbx, r8
xor edi, edi
and dword [rax], edi
xor r9d, r9d
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
mov esi, edx
mov rbp, rcx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x180053de1
mov edx, dword [rsp + 0x58]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180053de1
lea rcx, [rsp + 0x58]
mov r9, rax
mov r8d, 0x40000001
mov qword [rsp + 0x20], rcx
mov rcx, rbp
mov edx, esi
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov edi, eax
test eax, eax
jne 0x180053de1
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x180053e6c
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
lea rax, [rax - 0x28]
mov rbp, r9
mov rsi, rcx
xor ebx, ebx
mov dword [rax], ebx
mov r8d, 0x80000001
mov edx, r14d
xor r9d, r9d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x180053f13
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180053f13
lea rax, [rsp + 0x30]
mov r9, rdi
mov r8d, 0x80000001
mov edx, r14d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x180053f0a
lea rdx, str._____BEGIN__s______n_s_____END__s______n
mov r9, rdi
mov r8, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call fcn.180053fbc
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x1800546a0
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
mov r14, rdx
lea rax, [r11 - 0x28]
lea r8, [r11 + 0x20]
lea r9d, [rbx + 4]
lea edx, [rbx + 8]
mov rsi, rcx
xor edi, edi
mov qword [r11 - 0x38], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180054775
mov eax, dword [rsp + 0x78]
cmp eax, 1
jne 0x18005472f
lea rax, [rsp + 0x38]
lea r9d, [rbx + 1]
lea edx, [rbx + 8]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
test eax, eax
jne 0x180054739
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___DuplicateTokenEx__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov eax, dword [rsp + 0x78]
jmp 0x180054734
mov qword [rsp + 0x38], rsi
cmp eax, 1
je 0x180054789
mov rcx, qword [rsp + 0x38]
mov r8, rbp
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ebx, eax
test eax, eax
jne 0x180054764
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___CheckTokenMembership__0x_08x__n
mov edx, eax
call fcn.18004d68c
test edi, edi
je 0x180054789
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180054789
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___GetTokenInformation__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800548d8
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor esi, esi
test r9, r9
lea rbp, [r11 - 0x24]
cmovne rbp, r9
and dword [rsp + 0x40], esi
and dword [r11 + 0x20], esi
mov qword [r11 - 0x38], rbp
mov rbx, rdx
mov r14, rcx
lea rax, [r11 + 0x20]
mov rdx, rcx
mov rcx, qword [rsp + 0x90]
mov rdi, r8
mov qword [r11 - 0x40], rax
and qword [r11 - 0x48], rsi
lea r9, [r11 - 0x28]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1800549c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800549c9
mov edx, dword [rsp + 0x40]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1800549c9
mov edx, dword [rsp + 0x88]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x1800549bd
mov r8, qword [rbx]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x40]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
test eax, eax
jne 0x1800549c9
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov eax, esi
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x1800557bc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
lea r9, [rsp + 0x40]
lea edx, [rbx + 0x10]
lea r8d, [rbx + 0x40]
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18005581e
movups xmm0, xmmword [rsi]
mov r8d, dword [rsp + 0x40]
mov ebx, 1
lea r9, [rsp + 0x40]
lea edx, [rbx + 0xf]
mov rcx, rdi
movdqu xmmword [rdi], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180055832
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_rpc_replace_first_routine_pair_direct___VirtualProtect_post___0x_08x__n
jmp 0x18005582b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_rpc_replace_first_routine_pair_direct___VirtualProtect_pre___0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret