joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e9a0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
mov edx, 1
mov ebx, r8d
call fcn.140015308
test ebx, ebx
je 0x14000e9d5
cmp ebx, 1
jne 0x14000e9e8
lea r8d, [rbx + 1]
jmp 0x14000e9d8
xor r8d, r8d
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x48]
test eax, eax
jne 0x14000e9ef
xor eax, eax
jmp 0x14000eabc
mov rcx, qword [rdi + 0x230]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14000eab7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
mov edx, 3
mov ebx, eax
call fcn.140015308
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140047f50]
mov r8d, 1
call fcn.140015174
mov rcx, qword [rdi + 0x10]
mov edx, ebx
call fcn.140015b9c
mov r8, qword [rdi + 0x230]
lea rdx, str._IXStream__Handle__p_
mov rcx, qword [rdi + 0x10]
call fcn.1400156d0
mov r9, qword [rdi + 0x258]
test r9, r9
jne 0x14000ea70
lea r9, [rdi + 0x18]
mov rax, qword [r9 + 0x210]
test rax, rax
cmovne r9, rax
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140047f50]
mov r8d, 0x6d64
call fcn.140015490
mov r8, qword [rdi + 0x258]
test r8, r8
jne 0x14000eaa4
lea r8, [rdi + 0x18]
mov rax, qword [r8 + 0x210]
test rax, rax
cmovne r8, rax
mov rcx, qword [rdi + 0x10]
mov edx, 1
call fcn.1400157a8
jmp 0x14000e9e8
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000f0d4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140005b50
test eax, eax
je 0x14000f15d
mov ebx, 1
lea rdx, [0x140047f50]
mov r8d, ebx
xor ecx, ecx
call fcn.140015174
mov r9, rbp
lea rdx, [0x140047f50]
mov r8d, 0x6ddb
xor ecx, ecx
call fcn.140015468
mov r8, rbp
mov edx, ebx
xor ecx, ecx
call fcn.1400157a8
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f174
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebp, ebp
jne 0x14000f200
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000f200
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.14000f93c
test eax, eax
je 0x14000f1fc
mov edx, dword [rsp + 0x38]
mov rcx, rsi
and edx, 0xfffffffe
call fcn.14000fa20
test eax, eax
je 0x14000f1fc
mov rcx, rsi
call fcn.14000f0d4
jmp 0x14000f244
xor eax, eax
jmp 0x14000f244
call fcn.140005b50
test eax, eax
je 0x14000f242
mov ebx, 1
lea rdx, [0x140047f50]
mov r8d, ebx
xor ecx, ecx
call fcn.140015174
mov r9, rsi
lea rdx, [0x140047f50]
mov r8d, 0x6ddb
xor ecx, ecx
call fcn.140015468
mov r8, rsi
mov edx, ebx
xor ecx, ecx
call fcn.1400157a8
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14000f25c
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov rbp, rdx
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rdx, r14
mov rcx, rbp
mov edi, eax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140005b50
test eax, eax
je 0x14000f302
mov ebx, 1
lea rdx, [0x140047f50]
mov r8d, ebx
xor ecx, ecx
call fcn.140015174
mov r9, r14
mov qword [rsp + 0x20], rbp
mov r8d, 0x6ddc
lea rdx, [0x140047f50]
xor ecx, ecx
call fcn.140015468
mov r8, rbp
mov edx, ebx
xor ecx, ecx
call fcn.1400157a8
mov r8, r14
lea edx, [rbx + 1]
xor ecx, ecx
call fcn.1400157a8
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14000f340
Capabilities:
Copy file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov rbx, r8
mov ecx, 0x8001
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140005b50
test eax, eax
je 0x14000f3f4
mov ebx, 1
lea rdx, [0x140047f50]
mov r8d, ebx
xor ecx, ecx
call fcn.140015174
mov r9, r14
mov qword [rsp + 0x20], rbp
mov r8d, 0x6ddd
lea rdx, [0x140047f50]
xor ecx, ecx
call fcn.140015468
mov r8, rbp
mov edx, ebx
xor ecx, ecx
call fcn.1400157a8
mov r8, r14
lea edx, [rbx + 1]
xor ecx, ecx
call fcn.1400157a8
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14000f554
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
movsxd rdx, edx
mov eax, 0x3a
dec rdx
mov r9b, r8b
mov rsi, rcx
cmp ax, word [rcx + rdx*2]
jne 0x14000f58b
test r8b, r8b
je 0x14000f5e7
jmp 0x14000f5b5
call fcn.140012c14
xor ebx, ebx
mov rdi, rax
mov bpl, bl
lea r14d, [rbx + 0x5c]
test rax, rax
je 0x14000f5ce
lea rax, [rcx + 2]
cmp rax, rdi
jne 0x14000f5c7
cmp word [rcx], r14w
jne 0x14000f5c7
test r9b, r9b
je 0x14000f5c4
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000f631
mov bpl, 1
cmp rsi, rdi
cmove rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000f5e2
mov ecx, eax
call fcn.14000f64c
jmp 0x14000f631
test bpl, bpl
je 0x14000f5ee
mov eax, 1
jmp 0x14000f631
test rdi, rdi
je 0x14000f612
mov rdx, rdi
mov word [rdi], bx
sub rdx, rsi
xor r8d, r8d
sar rdx, 1
mov rcx, rsi
call fcn.14000f554
test eax, eax
je 0x14000f5c0
mov word [rdi], r14w
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x18
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000f964
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rbx, r8
mov ecx, 0x8001
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140005b50
xor ebx, ebx
test eax, eax
je 0x14000fa00
lea edi, [rbx + 1]
xor ecx, ecx
mov r8d, edi
lea rdx, [0x140047f50]
call fcn.140015174
mov r9d, dword [rsi]
lea rdx, [0x140047f50]
mov r8d, 0x6de2
mov qword [rsp + 0x20], rbp
xor ecx, ecx
call fcn.140015468
mov r8, rbp
mov edx, edi
xor ecx, ecx
call fcn.1400157a8
cmp dword [rsi], 0xffffffff
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000fa20
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov r14d, edx
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, r14d
mov rcx, rbp
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140005b50
test eax, eax
je 0x14000fab9
mov ebx, 1
lea rdx, [0x140047f50]
mov r8d, ebx
xor ecx, ecx
call fcn.140015174
mov r9d, r14d
mov qword [rsp + 0x20], rbp
mov r8d, 0x6de2
lea rdx, [0x140047f50]
xor ecx, ecx
call fcn.140015468
mov r8, rbp
mov edx, ebx
xor ecx, ecx
call fcn.1400157a8
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14000fad8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
and dword [rdx + 8], 0
mov rbx, rcx
and dword [rdx + 0xc], 0
mov ecx, 0x8001
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
call fcn.140017da8
mov rcx, rbx
test eax, eax
je 0x14000fb30
and dword [rsp + 0x28], 0
lea r8, [rsp + 0x30]
and qword [rsp + 0x20], 0
xor r9d, r9d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
jmp 0x14000fb3b
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rdi], 0xffffffffffffffff
jne 0x14000fba2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000fb6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140005b50
test eax, eax
je 0x14000fb9e
mov r8d, 1
lea rdx, [0x140047f50]
xor ecx, ecx
call fcn.140015174
mov r8d, 0x6de7
lea rdx, [0x140047f50]
xor ecx, ecx
call fcn.140015468
xor eax, eax
jmp 0x14000fbcc
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000fd70
mov rcx, rdi
test eax, eax
jne 0x14000fbbd
call fcn.14000fbe4
jmp 0x14000fbcc
lea rdx, [rsp + 0x30]
call fcn.1400101d8
mov eax, 1
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14000fdf8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rdx, rbx
mov ecx, 0x104
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x14000fe74
call fcn.140005b50
test eax, eax
je 0x14000fe7c
lea r8d, [rsi + 1]
xor ecx, ecx
lea rdx, [0x140047f50]
call fcn.140015174
mov r8d, 0x6de5
lea rdx, [0x140047f50]
xor ecx, ecx
call fcn.140015468
jmp 0x14000fe7c
cmp esi, 0x104
jbe 0x14000fe80
xor eax, eax
jmp 0x14000fe85
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000fe98
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rbp, r8
mov ecx, 0x8001
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov r9, rbx
xor r8d, r8d
mov rdx, rbp
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
test esi, esi
setne bl
call fcn.140005b50
test eax, eax
je 0x14000ff33
mov r8d, 1
lea rdx, [0x140047f50]
xor ecx, ecx
call fcn.140015174
mov r9, r14
mov qword [rsp + 0x20], rbp
mov r8d, 0x6de6
lea rdx, [0x140047f50]
xor ecx, ecx
call fcn.140015468
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14001023c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov r8, rcx
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov edx, 0x105
call fcn.1400129cc
lea rcx, [rsp + 0x20]
call fcn.140012950
lea rcx, [rsp + 0x20]
call fcn.14000f670
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x20]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x230]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400111d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, edx
mov ebx, edx
shr eax, 4
mov rsi, r8
movzx edx, ax
mov r8d, 6
inc edx
mov ebp, r9d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r14d, r14d
test rax, rax
je 0x14001129e
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001129e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
and ebx, 0xf
jbe 0x140011253
mov eax, ebx
movzx ecx, word [rdx]
lea rdx, [rdx + rcx*2]
add rdx, 2
sub rax, 1
jne 0x140011242
movzx edi, word [rdx]
test rsi, rsi
jne 0x14001125f
mov eax, edi
jmp 0x1400112a0
test ebp, ebp
jne 0x14001126c
lea rax, [rdx + 2]
mov qword [rsi], rax
jmp 0x14001125b
lea eax, [rbp - 1]
cmp eax, edi
cmovge eax, edi
movsxd rdi, eax
test eax, eax
jle 0x140011295
lea rbx, [rdi + rdi]
add rdx, 2
mov r8, rbx
mov rcx, rsi
call fcn.140020ea0
mov word [rbx + rsi], r14w
jmp 0x14001125b
cmp ebp, 1
jle 0x14001125b
mov word [rsi], r14w
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400112bc
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [0x1400581a8], 0
je 0x1400112d6
mov eax, 1
jmp 0x1400113bb
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400113b9
lea rdx, str.NtOpenKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400581a8], rax
test rax, rax
je 0x1400113b9
lea rdx, str.NtClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryValueKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlAnsiStringToUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlFreeUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov rcx, rbx
mov qword [0x1400581a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlCreateSecurityDescriptor
mov rcx, rbx
mov qword [0x140058198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetSecurityObject
mov rcx, rbx
mov qword [0x140058190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400112cc
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140017d50
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, 1
cmp eax, ecx
jne 0x140017d92
cmp dword [rsp + 0x30], 2
jne 0x140017d92
cmp dword [rsp + 0x24], 6
jb 0x140017d8b
cmp dword [rsp + 0x28], ebx
jae 0x140017d94
cmp dword [rsp + 0x24], 7
jae 0x140017d94
xor ecx, ecx
mov eax, ecx
add rsp, 0x140
pop rbx
ret
mov edx, 1
jmp 0x140017d50

Function at 0x140017da8
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, 1
cmp eax, ecx
jne 0x140017d92
cmp dword [rsp + 0x30], 2
jne 0x140017d92
cmp dword [rsp + 0x24], 6
jb 0x140017d8b
cmp dword [rsp + 0x28], ebx
jae 0x140017d94
cmp dword [rsp + 0x24], 7
jae 0x140017d94
xor ecx, ecx
mov eax, ecx
add rsp, 0x140
pop rbx
ret
mov edx, 1
jmp 0x140017d50

Function at 0x140017e10
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xf]
sub rsp, 0x90
cmp dword [rbp + 0x6f], 0
mov rbx, rdx
mov rdi, rcx
mov dword [rbp - 0x61], 0x70
mov dword [rbp - 0x5d], 0x440
je 0x140017e48
and qword [rbp - 0x59], 0
jmp 0x140017e52
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rbp - 0x59], rax
neg dword [rbp + 0x7f]
lea rcx, str.runas
xorps xmm0, xmm0
mov qword [rbp - 0x49], rdi
sbb rax, rax
mov qword [rbp - 0x41], rbx
and qword [rbp - 0x29], 0
and rax, rcx
and qword [rbp - 0x11], 0
and dword [rbp - 9], 0
mov qword [rbp - 0x51], rax
mov rax, qword [rbp + 0x57]
mov qword [rbp - 0x39], rax
mov rax, qword [rbp + 0x5f]
movdqa xmmword [rbp - 0x21], xmm0
movdqa xmmword [rbp - 1], xmm0
movzx ecx, word [rax + 0x40]
mov dword [rbp - 0x31], ecx
lea rcx, [rbp - 0x61]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140017eb5
mov rdx, qword [rbp + 0x67]
mov rcx, qword [rbp + 7]
mov qword [rdx], rcx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140017ecc
Capabilities:
Create process on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x100
lea rbp, [rsp + 0x70]
mov qword [rbp + 0xb0], rbx
mov r14, rdx
mov qword [rbp + 0xb8], rsi
mov r15, rcx
mov qword [rbp + 0xc0], rdi
lea rcx, [rbp + 0x20]
mov rdi, r8
mov qword [rbp + 0xc8], r12
mov esi, 0x68
xor edx, edx
mov r8d, esi
mov ebx, r9d
call fcn.140021310
lea eax, [rsi - 0x67]
mov dword [rbp + 0x20], esi
xor edx, edx
mov word [rbp + 0x60], ax
lea r8d, [rsi - 0x50]
lea rcx, [rbp]
call fcn.140021310
xor r12d, r12d
mov qword [rbp], r12
call fcn.140017da0
mov rcx, r15
test eax, eax
je 0x140017f77
mov eax, dword [rbp + 0xd8]
mov rdx, r14
mov dword [rsp + 0x60], eax
lea rax, [rbp]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.140017e10
jmp 0x140018089
call fcn.140026704
mov rcx, r14
mov rbx, rax
call fcn.140026704
add eax, 2
add eax, ebx
movabs rbx, 0xffffffffffffff0
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140017fa7
mov rcx, rbx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140037ab0
sub rsp, rcx
mov rdx, r15
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1400266bc
lea rdx, [0x1400466c0]
mov rcx, rsi
call fcn.1400266d8
mov rdx, r14
mov rcx, rsi
call fcn.1400266d8
test rdi, rdi
je 0x140017ffc
cmp word [rdi], r12w
je 0x140017ffc
mov rcx, rdi
call fcn.140026704
lea ecx, [rax*2 + 2]
jmp 0x140018001
mov ecx, 2
movsxd rax, ecx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140018010
mov rcx, rbx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140037ab0
sub rsp, rcx
lea rbx, [rsp + 0x70]
test rdi, rdi
je 0x140018036
mov rdx, rdi
mov rcx, rbx
call fcn.1400266bc
jmp 0x14001803a
mov word [rbx], r12w
lea rcx, [rbp]
neg rdi
mov qword [rsp + 0x48], rcx
mov rdx, rsi
sbb rax, rax
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x40], rcx
and rax, rbx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], r12d
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140018089
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp]
mov rbx, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0xb8]
mov rdi, qword [rbp + 0xc0]
mov r12, qword [rbp + 0xc8]
lea rsp, [rbp + 0x90]
pop r15
pop r14
pop rbp
ret

Function at 0x140018bd0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140055b94], eax
add rsp, 0x28
ret
Function at 0x140018cc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [rcx]
lea r8, [r11 + 0x18]
xor r12d, r12d
mov dword [rsp + 0x60], 0x80000000
lea rdx, [r11 - 0x58]
mov dword [r11 + 0x18], r12d
mov rdi, r9
mov rsi, rcx
call qword [rax + 0x50]
mov ebp, dword [rdi + 8]
mov r14d, dword [rdi + 0xc]
mov ecx, dword [0x140055b94]
sub ebp, dword [rdi]
sub r14d, dword [rdi + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdx, [rsp + 0x68]
mov rcx, rsi
mov r15, rax
call fcn.1400191c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [rsi]
mov rcx, rsi
mov dword [rsi + 0x38], 1
call qword [rdx + 0x90]
mov rdx, qword [rsi]
mov rcx, rsi
test eax, eax
je 0x140018e01
mov qword [rsp + 0xc0], r12
call qword [rdx + 0x48]
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.140012bcc
lea rdx, [0x1400446c8]
mov qword [rsp + 0xc8], r12
lea rcx, [rsp + 0xc8]
call fcn.140012bcc
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x58]
mov r9d, dword [rsp + 0x60]
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
mov ecx, dword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x50], rax
mov eax, dword [rdi + 4]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
mov eax, dword [rdi]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [rsp + 0xc0]
call fcn.140026e1c
mov rcx, qword [rsp + 0xc8]
call fcn.140026e1c
jmp 0x140018e5e
call qword [rdx + 0x58]
mov rdx, qword [rsi]
mov rcx, rsi
mov rbx, rax
call qword [rdx + 0x48]
mov r9d, dword [rsp + 0x60]
lea r8, [0x1400446c8]
mov ecx, dword [rsp + 0xd0]
mov rdx, rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov eax, dword [rdi + 4]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
mov eax, dword [rdi]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [rsi + 0x38], r12d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp qword [rsp + 0x70], r12
je 0x140018e7b
lea rcx, [rsp + 0x68]
call fcn.140019220
mov ecx, dword [0x140055b94]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, ebx
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400191c0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x140055b94]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x140019250]
mov r9d, eax
lea ecx, [r8 + 5]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], 0
add rsp, 0x20
pop rdi
ret