joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035a20
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movaps xmm0, xmmword [str.expand_32_byte_k]
movups xmmword [rcx], xmm0
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
mov dword [rcx + 0x80], 0x40
ret
Function at 0x140036f60
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov r9, qword [rdx + 8]
test r9, r9
je 0x140036fc3
mov r8, qword [rdx]
xor r10d, r10d
movzx ecx, byte [r8 + r10]
xor ecx, eax
mov eax, ecx
and eax, 0xf
shr ecx, 4
imul edx, eax, 0x11111044
xor edx, ecx
imul r11d, eax, 0x8840020
imul ecx, eax, 0x4220000
xor ecx, r11d
xor ecx, edx
and edx, 0xf
shr ecx, 4
imul eax, edx, 0x11111044
imul r11d, edx, 0x8840020
xor r11d, eax
imul eax, edx, 0x4220000
xor eax, ecx
xor eax, r11d
inc r10
cmp r9, r10
jne 0x140036f71
ret

Function at 0x14003882f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov rax, rcx
mov qword [rsp + 8], rcx
shr rax, 0x20
mov r10d, dword [rdx + r8*4]
mov r11d, eax
rol r11d, 4
xor r11d, dword [rdx + r8*4 + 0x40]
mov qword [rsp + 0x10], rax
xor r10d, eax
mov eax, 0xfc00fc
mov ebp, r11d
and ebp, eax
mov edx, 0xff00ff00
or ebp, edx
shr r11d, 8
and r11d, eax
or r11d, edx
mov r8d, r10d
and r8d, eax
or r8d, edx
shr r10d, 8
and r10d, eax
or r10d, edx
xor r13d, r13d
lea rax, [0x140086b80]
mov r12d, 0x80008
lea r15, [0x140086d80]
mov dword [rsp], ebp
xor esi, esi
xor edi, edi
xor ebx, ebx
mov edx, r10d
mov dword [rsp + 4], r8d
mov r14d, r11d
mov r9d, dword [rax]
and r9d, ebp
xor ebx, r9d
add ebp, r12d
mov ecx, dword [rax + 4]
and ecx, r14d
xor edi, ecx
add r14d, r12d
mov ecx, dword [rax + 8]
and ecx, r8d
xor esi, ecx
add r8d, r12d
mov ecx, dword [rax + 0xc]
and ecx, edx
xor r13d, ecx
add edx, r12d
add rax, 0x10
cmp rax, r15
jb 0x1400388bc
mov eax, 0x100
mov edx, dword [rsp + 4]
add edx, eax
mov ebp, dword [rsp]
add ebp, eax
add r11d, eax
add r10d, eax
mov ecx, ebx
shl ecx, 4
mov r8d, 0x40004
and ebp, r8d
imul eax, ebp, 0x3c00
and eax, ecx
xor eax, ebx
mov ebp, edi
shl ebp, 4
and r11d, r8d
imul ecx, r11d, 0x3c00
and ecx, ebp
xor ecx, edi
mov ebx, esi
shl ebx, 4
and edx, r8d
imul ebp, edx, 0x3c00
and ebp, ebx
xor ebp, esi
mov ebx, r13d
shl ebx, 4
and r10d, r8d
imul edx, r10d, 0x3c00
and edx, ebx
xor edx, r13d
and edx, 0xf000f000
shr eax, 0xc
and eax, 0xf000f
shr ecx, 4
and ecx, 0xf000f00
shr ebp, 8
and ebp, 0xf000f0
or ebp, ecx
or ebp, edx
or eax, ebp
shr ebp, 4
xor ebp, eax
and ebp, 0x7030702
xor eax, ebp
shl ebp, 4
xor ebp, eax
mov ecx, ebp
shr ecx, 8
xor ecx, eax
and ecx, 0x4e009e
xor ebp, ecx
shl ecx, 8
xor ecx, ebp
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0xd9d3
xor ecx, eax
shl eax, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 4
xor ecx, eax
and ecx, 0x5040004
mov edx, ecx
xor edx, eax
shl ecx, 4
shr eax, 1
xor eax, edx
and eax, 0x4045015
xor ecx, dword [rsp + 8]
xor ecx, edx
xor ecx, eax
add eax, eax
xor eax, ecx
shl rax, 0x20
add rax, qword [rsp + 0x10]
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003d916
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 8], 0
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x14003d985
xor ecx, ecx
sub r8, rcx
add rcx, qword [rsi]
mov edx, 1
mov r9, rdi
call fcn.140067964
mov rbx, rax
mov rcx, rdi
call fcn.140066f84
test eax, eax
jne 0x14003d973
mov rcx, qword [rsi + 8]
test rbx, rbx
je 0x14003d97a
add rcx, rbx
mov qword [rsi + 8], rcx
mov r8, qword [rsi + 0x10]
cmp r8, rcx
ja 0x14003d936
jmp 0x14003d97e
mov eax, 2
jmp 0x14003d9bd
mov r8, qword [rsi + 0x10]
xor eax, eax
cmp rcx, r8
jne 0x14003d99b
mov rcx, rdi
call fcn.140067304
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi]
lea rbx, [rsi + 0x18]
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x28], rcx
mov qword [rsi + 0x20], 0
mov dword [rsi + 0x30], 0
mov qword [rsi + 0x38], rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140041f50
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.14000977d

Function at 0x140042129
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, r9
mov ebx, r8d
mov r14, rdx
mov r12, rcx
mov ebp, dword [rsp + 0x110]
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [rcx]
mov rdi, rax
test rax, rax
je 0x140042174
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test ebp, ebp
jle 0x140042209
movsxd r15, ebx
xor ebx, ebx
mov r13d, ebp
mov rax, qword [r12 + 0x28]
cmp rax, r13
cmovb r13, rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
cmp qword [r12 + 0x28], 0x73
jb 0x1400421ba
lea rcx, str.h__hlen___MAX_HASH_LEN
lea rdx, str..._sshrsa.c
mov r8d, 0x393
call fcn.140065644
mov rcx, qword [rdi + 8]
mov rdx, r14
mov r8, r15
call fcn.14000810c
mov rcx, qword [rdi + 8]
mov edx, ebx
call fcn.140008210
mov rax, qword [rdi]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [rax + 0x18]
test r13d, r13d
jle 0x1400421f8
xor eax, eax
mov cl, byte [rsp + rax + 0x20]
xor byte [rsi + rax], cl
inc rax
cmp r13, rax
jne 0x1400421e9
inc ebx
movsxd rax, r13d
add rsi, rax
sub ebp, r13d
jg 0x140042181
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400575f0
nop
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140044054
Capabilities:
Hash data using sha1 via x86 extensions

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm9, xmmword [rcx]
movdqa xmm8, xmmword [rcx + 0x10]
movdqa xmm6, xmmword [0x140084a20]
movdqu xmm5, xmmword [rdx]
movdqu xmm4, xmmword [rdx + 0x10]
movdqu xmm3, xmmword [rdx + 0x20]
movdqu xmm2, xmmword [rdx + 0x30]
pshufb xmm5, xmm6
movdqa xmm7, xmm8
paddd xmm7, xmm5
movdqa xmm1, xmm9
sha1rnds4 xmm1, xmm7, 0
pshufb xmm4, xmm6
movdqa xmm7, xmm9
sha1nexte xmm7, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm5, xmm4
pshufb xmm3, xmm6
sha1nexte xmm1, xmm3
movaps xmm7, xmm0
sha1rnds4 xmm7, xmm1, 0
sha1msg1 xmm4, xmm3
pshufb xmm2, xmm6
sha1nexte xmm0, xmm2
pxor xmm5, xmm3
sha1msg2 xmm5, xmm2
movaps xmm1, xmm7
sha1rnds4 xmm1, xmm0, 0
sha1msg1 xmm3, xmm2
sha1nexte xmm7, xmm5
pxor xmm4, xmm2
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm6, xmm2
sha1msg2 xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 1
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm1, xmm5
sha1msg2 xmm4, xmm5
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm0, xmm4
sha1msg2 xmm3, xmm4
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm6, xmm3
sha1msg2 xmm2, xmm3
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm1, xmm2
sha1msg2 xmm5, xmm2
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm0, xmm5
sha1msg2 xmm4, xmm5
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 2
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm6, xmm4
sha1msg2 xmm3, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm1, xmm3
sha1msg2 xmm2, xmm3
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm0, xmm2
sha1msg2 xmm5, xmm2
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 3
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm6, xmm5
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 3
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm5, xmm0
sha1rnds4 xmm5, xmm1, 3
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm5
sha1rnds4 xmm1, xmm0, 3
sha1nexte xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm5, 3
paddd xmm0, xmm9
movdqa xmmword [rcx], xmm0
sha1nexte xmm1, xmm8
movaps xmmword [rcx + 0x10], xmm1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14004bdd1
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
movsx esi, byte [rcx + rax]
lea ebx, [rsi - 0x41]
cmp bl, 0x19
ja 0x14004bdfb
add esi, 0xffffffbf
jmp 0x14004be3e
lea ebx, [rsi - 0x61]
cmp bl, 0x19
ja 0x14004be08
add esi, 0xffffffb9
jmp 0x14004be3e
lea ebx, [rsi - 0x30]
cmp bl, 9
ja 0x14004be15
add esi, 4
jmp 0x14004be3e
cmp sil, 0x2b
je 0x14004be32
cmp sil, 0x3d
je 0x14004be39
cmp sil, 0x2f
jne 0x14004bebd
mov esi, 0x3f
jmp 0x14004be3e
mov esi, 0x3e
jmp 0x14004be3e
mov esi, 0xffffffff
mov dword [rsp + rax*4 + 0x20], esi
inc rax
cmp rax, 4
jne 0x14004bdea
mov edi, dword [rsp + 0x20]
xor ebp, ebp
cmp edi, 0xffffffff
je 0x14004bebf
mov esi, dword [rsp + 0x24]
cmp esi, 0xffffffff
je 0x14004bebf
mov eax, dword [rsp + 0x28]
mov ebx, dword [rsp + 0x2c]
cmp eax, 0xffffffff
je 0x14004beac
mov ebp, 2
mov ecx, ebx
and ecx, eax
shl edi, 0x12
shl esi, 0xc
or edi, esi
shl eax, 6
shr edi, 0x10
mov byte [rdx], dil
cmp ecx, 0xffffffff
je 0x14004be98
mov ecx, eax
and ecx, 0xf00
or ecx, esi
mov byte [rdx + 1], ch
cmp ebx, 0xffffffff
je 0x14004bebf
and ebx, 0x3f
or ebx, eax
mov byte [rdx + 2], bl
mov ebp, 3
jmp 0x14004bebf
cmp ebx, 0xffffffff
jne 0x14004bebf
mov ebp, 1
mov ebx, 0xffffffff
jmp 0x14004be71
xor ebp, ebp
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400575f0
mov eax, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x14004c249
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14004c27b
xor r10d, r10d
xor r9d, r9d
mov al, byte [rdx + r10]
xor al, byte [rcx + r10]
movzx eax, al
or r9d, eax
inc r10
cmp r8, r10
jne 0x14004c254
mov eax, 0x100
sub eax, r9d
cmp eax, 0xff
seta al
ret
mov al, 1
ret
Function at 0x14004e768
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 1
mov edx, 0x1048
xor r8d, r8d
call fcn.1400087f8
mov rsi, rax
mov dword [rax], 0
lea r14, [rax + 8]
mov qword [rax + 8], rbp
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x10], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x1040], rbx
mov byte [rsi + 0x22], 0
mov word [rsi + 0x20], 0
mov qword [rsi + 0x28], rdi
mov dword [rsi + 0x30], r15d
mov rcx, qword [0x1400ac540]
test rcx, rcx
jne 0x14004e814
lea rcx, [0x14004e863]
call fcn.14004a0c8
mov rcx, rax
mov qword [0x1400ac540], rax
mov rdx, rsi
call fcn.14004a190
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14004e87a]
xor ecx, ecx
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [rsi + 0x23], 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400575f0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14004e9fa
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r15d, r9d
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r12d, r12d
mov ecx, 1
mov edx, 0x1048
xor r8d, r8d
call fcn.1400087f8
mov rsi, rax
mov dword [rax], 1
lea r14, [rax + 8]
mov qword [rax + 8], rbp
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x10], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x18], rax
mov dword [rsi + 0x20], r12d
mov qword [rsi + 0x28], rbx
lea rcx, [rsi + 0x50]
call fcn.14004bed7
mov dword [rsi + 0x78], r12d
mov qword [rsi + 0x80], rdi
mov dword [rsi + 0x30], r15d
mov rcx, qword [0x1400ac540]
test rcx, rcx
jne 0x14004eab2
lea rcx, [0x14004e863]
call fcn.14004a0c8
mov rcx, rax
mov qword [0x1400ac540], rax
mov rdx, rsi
call fcn.14004a190
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14004eaff]
xor ecx, ecx
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400575f0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14004f822
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x1400ac560], 0
je 0x14004f849
mov rsi, qword [0x1400ac558]
jmp 0x14004f88e
lea rcx, str.secur32.dll
call fcn.14004f95d
mov rsi, rax
lea rcx, str.sspicli.dll
call fcn.14004f95d
test rsi, rsi
je 0x14004f87e
lea rdx, str.GetUserNameExA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x14004f880
xor esi, esi
mov qword [0x1400ac558], rsi
mov byte [0x1400ac560], 1
test rsi, rsi
je 0x14004f8f0
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, 8
xor edx, edx
mov r8, rdi
call rsi
mov ecx, dword [rdi]
mov edx, 1
xor r8d, r8d
call fcn.1400087f8
mov rsi, rax
mov ecx, 8
mov rdx, rax
mov r8, rdi
call qword [0x1400ac558]
test al, al
je 0x14004f8e8
mov rcx, rsi
mov edx, 0x40
call fcn.140058d30
test rax, rax
je 0x14004f946
mov byte [rax], 0
jmp 0x14004f946
mov rcx, rsi
call fcn.140008872
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14004f90d
mov ecx, dword [rsp + 0x2c]
jmp 0x14004f91a
mov dword [rsp + 0x2c], 0x100
mov ecx, 0x100
mov edx, 1
xor r8d, r8d
call fcn.1400087f8
mov rsi, rax
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x14004f946
mov rcx, rsi
call fcn.140008872
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400575f0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14004f95d
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [0x1400ac598], 0
jne 0x14004f9da
mov edx, dword [0x1400ac5a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r9d, eax
cmp qword [0x1400ac5a0], r9
ja 0x14004f9da
lea rdi, [0x1400ac5a0]
mov rbx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rcx, qword [0x1400ac598]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rdx, rdi
call fcn.14000887c
mov qword [0x1400ac598], rax
mov edx, dword [0x1400ac5a0]
mov rcx, rax
call rbx
mov r9d, eax
cmp qword [0x1400ac5a0], r9
jbe 0x14004f999
mov rcx, qword [0x1400ac598]
lea rdx, [0x140098517]
mov r8, rsi
xor r9d, r9d
call fcn.14004b74e
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rcx, rsi
call fcn.140008872
mov rax, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400526c0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov r14, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x107
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rcx, rdi
call fcn.140069a20
mov word [rsp + rax + 0x50], 0x2a5c
mov byte [rsp + rax + 0x52], 0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x140052751
mov rdi, rax
lea rbx, [rsp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rcx, rbx
mov edx, 0x140
call r14
mov rcx, rdi
mov rdx, rbx
call rsi
test eax, eax
jne 0x140052731
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x2c]
mov dword [rcx], eax
mov edx, 4
call r14
lea rcx, [rsp + 0x30]
mov edx, 0x20
call fcn.14005257c
test al, al
je 0x140052796
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov edx, 0x20
call r14
mov edx, 0x20
mov rcx, rdi
call fcn.14004fd54
mov rcx, r14
call fcn.140055b9a
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400575f0
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400527bc
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rsi, [rsp + 0x78]
mov qword [rsi], rax
mov ecx, 9
mov rdx, rsi
mov r8d, 8
call fcn.140040b2c
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsi], rax
mov ecx, 0xa
mov rdx, rsi
mov r8d, 8
call fcn.140040b2c
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsi], rax
mov ecx, 0xb
mov rdx, rsi
mov r8d, 8
call fcn.140040b2c
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
lea rdx, [rsp + 0x74]
mov dword [rdx], eax
mov ecx, 0xc
mov r8d, 4
call fcn.140040b2c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov rdx, rsi
mov r8d, 8
call fcn.140040b2c
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov rdx, rsi
mov r8d, 0x38
call fcn.140040b2c
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov rdx, rbx
mov r8d, 0x20
call fcn.140040b2c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov rdx, rbx
mov r8d, 0x20
call fcn.140040b2c
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400575f0
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400529fc
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, str..pipe_
mov r8d, 9
call fcn.140069ae0
test eax, eax
je 0x140052a4d
lea rcx, str.strncmp_pipename___.pipe___9___0
lea rdx, str..._windows_winnpc.c
mov r8d, 0x18
call fcn.140065644
lea rcx, [rdi + 9]
mov edx, 0x5c
call fcn.140058d30
test rax, rax
je 0x140052a79
lea rcx, str.strchr_pipename__9_____NULL
lea rdx, str..._windows_winnpc.c
mov r8d, 0x19
call fcn.140065644
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rsi
cmp rax, 0xffffffffffffffff
jne 0x140052aed
call r15
cmp eax, 0xe7
jne 0x140052b58
mov rcx, rdi
xor edx, edx
call r12
test eax, eax
jne 0x140052a8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004fa76
lea rcx, str.Error_waiting_for_named_pipe__s:__s
jmp 0x140052b6c
mov rbx, rax
call fcn.140053ad0
test rax, rax
je 0x140052b79
mov rsi, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x48]
mov rcx, rbx
mov edx, 6
mov r8d, 1
call qword [0x1400acd90]
test eax, eax
je 0x140052bc6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004fa76
lea rcx, str.Unable_to_get_named_pipe_security_information:__s
jmp 0x140052b96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004fa76
lea rcx, str.Unable_to_open_named_pipe__s:__s
mov rdx, rdi
mov r8, rax
call fcn.14004b6ab
jmp 0x140052b9e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004fa76
lea rcx, str.Unable_to_get_user_SID:__s
mov rdx, rax
call fcn.14004b6ab
mov qword [r14], rax
mov rbx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400575f0
mov rax, rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x140052be5
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140052ba8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, str.Owner_of_named_pipe__s_is_not_us
mov rdx, rdi
jmp 0x140052b99
Function at 0x140052dcd
Capabilities:
Create pipe

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov dword [rax], 0x18
mov rcx, qword [rcx]
mov qword [rax + 8], rcx
xor ebx, ebx
mov dword [rax + 0x10], ebx
movzx edx, dl
shl edx, 0x13
or edx, 0x40000003
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov eax, 0x1000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r8d, 8
mov r9d, 0xff
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsi + 0x18], rax
cmp rax, 0xffffffffffffffff
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400575f0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x140052e6a
Capabilities:
Connect pipe

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
lea rbx, [rcx + 0x20]
mov r15, qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [0x140052fee]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, 1
jne 0x140052ec8
mov rcx, qword [rsi + 0x18]
mov rdx, rbx
call r15
test eax, eax
jne 0x140052eca
call r12
test eax, eax
je 0x140052eca
mov ebp, eax
cmp eax, 0x217
je 0x140052eca
jmp 0x140052f55
xor edi, edi
mov rbp, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x48]
mov rax, qword [rcx]
mov rdx, r14
mov r8, rbp
call qword [rax + 0x20]
test eax, eax
je 0x140052ee8
mov rcx, rbp
call r13
mov rcx, rsi
xor edx, edx
call fcn.140052dcd
test al, al
jne 0x140052e9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, ebp
call fcn.14004fa76
lea rcx, str.Error_while_listening_to_named_pipe:__s
mov rdx, rax
call fcn.14004b6ab
mov rdi, rax
mov rcx, qword [rsi + 0x10]
call fcn.140050b12
mov rcx, qword [rsi + 0x48]
mov rbx, qword [rcx]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov edx, 1
mov r8, rax
xor r9d, r9d
call qword [rbx]
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140008872
cmp ebp, 0x3e5
jne 0x140052efe
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret