joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002550
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140002581
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400025f4
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140002598
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000259a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400025ee
test ecx, ecx
jle 0x1400025ce
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
add r14, rbp
test rbx, rbx
jle 0x1400025ee
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400025ee
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140002610
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002635
xor eax, eax
jmp 0x140002730
cmp qword [rcx + 0x68], 0
je 0x140002647
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140002730
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x14000265e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002660
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002690
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rsi
add r14, rbx
sub rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov r8, rbp
cmp qword [rsi + 0x80], 0
je 0x14000272a
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400026cb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140002704
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140002741
cmp rbp, r15
ja 0x1400026d9
mov r8, rbx
test rbx, rbx
je 0x14000272a
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x14000272d
Function at 0x140002ae8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140002b21
xor eax, eax
jmp 0x140002c34
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140002b4a
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x140002b4a
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140002c34
cmp qword [rcx + 0x80], 0
je 0x140002c32
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140002b85
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002ba9
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x140002c32
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002bf7
sub eax, 1
je 0x140002bf7
cmp eax, 2
jne 0x140002c32
movsx ecx, byte [rbp - 0x30]
jmp 0x140002b92
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140002c22
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x140002c32
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x140002c34
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140003a70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000308c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400030fb
cmp byte [rcx + 0x71], 0
je 0x1400030fb
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003150
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003115
sub eax, 1
je 0x140003119
cmp eax, 2
jne 0x140003150
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003a70
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003147
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003150
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400030fd
xor al, al
jmp 0x1400030fd
Function at 0x141192058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1411921df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141192089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14119206f
add dl, dl
jne 0x141192096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411920f6
xor eax, eax
add dl, dl
jne 0x1411920a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411921ad
add dl, dl
jne 0x1411920b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411920c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411920d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411920dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1411920ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14119207e
mov eax, 1
add dl, dl
jne 0x141192106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141192113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411920fb
sub eax, ebx
mov ebx, 1
jne 0x14119214c
mov ecx, 1
add dl, dl
jne 0x14119212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14119213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141192123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14119207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141192168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141192175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14119215d
cmp eax, 0x7d00
jae 0x14119219b
cmp eax, 0x500
jb 0x141192196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14119207e
cmp eax, 0x7f
ja 0x14119219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14119207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1411921d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14119207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140005760
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ebp, ebp
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call fcn.140013af0
cmp eax, ebp
mov ebx, eax
jl 0x140005848
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140013af0
mov ebx, eax
cmp eax, ebp
jne 0x140005843
mov rcx, qword [rsp + 0x28]
mov eax, 0x2f
cmp ax, word [rcx]
je 0x1400057e9
mov eax, 0x2d
cmp ax, word [rcx]
jne 0x140005825
lea rbx, [rcx + 2]
lea rcx, str.standalone
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebp
jne 0x140005809
mov dword [rsi], 1
jmp 0x1400057b1
lea rcx, str.standalone:temp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebp
jne 0x14000582c
mov dword [rdi], 1
jmp 0x1400057b1
mov ebx, 0x80070057
jmp 0x14000584d
lea rcx, str.standalone:delete
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebx, 0x80070057
jmp 0x140005848
cmp ebx, ebp
cmovge ebx, ebp
mov rcx, qword [rsp + 0x28]
cmp rcx, rbp
je 0x140005857
call fcn.140010338
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14000e820
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x11b0
call fcn.14001f7f4
sub rsp, rax
mov rax, qword [0x140027028]
xor rax, rsp
mov qword [rsp + 0x11a0], rax
mov rdi, qword [rsp + 0x1200]
and qword [rsp + 0x38], 0
mov rbx, rcx
and qword [rdi], 0
mov rsi, r8
mov r12, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x1154
mov rbp, r9
call fcn.140014560
lea rcx, [rsp + 0x48]
or r9, 0xffffffffffffffff
mov r8, rbx
mov edx, 0x80
mov dword [rsp + 0x40], 0x1154
mov dword [rsp + 0x44], 7
call fcn.140014638
lea rax, [rsp + 0x30]
lea rdx, str.Path
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x148]
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x30], 0x1048
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000e957
lea rax, [rsp + 0x30]
lea rdx, str.Priority
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1190]
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000e957
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r8, rbp
mov rcx, rsi
call fcn.14000e760
mov ebx, eax
test eax, eax
js 0x14000e957
mov rax, qword [rsp + 0x38]
xor edx, edx
xor ebx, ebx
mov qword [rdi], rax
mov qword [rsp + 0x38], rdx
jmp 0x14000e95c
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14000e974
mov rax, qword [rdx + 8]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + rdx + 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rcx, qword [rsp + 0x11a0]
xor rcx, rsp
call fcn.1400143fc
add rsp, 0x11b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000efd0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [rcx + 0x258]
xor edi, edi
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x14000effb
lea edi, [rcx + 2]
jmp 0x14000f0d5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 0x258], 0xffffffffffffffff
test esi, esi
je 0x14000f0d5
cmp dword [rbx + 0x18], edi
jne 0x14000f0d5
and qword [rsp + 0x30], rdi
and dword [rsp + 0x28], edi
lea rcx, [rbx + 0x34]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0x80070000
mov qword [rbx + 0x258], rax
cmp rax, 0xffffffffffffffff
jne 0x14000f066
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000f0d5
mov rdx, qword [rbx + 0x248]
mov rcx, qword [rbx + 0x258]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14000f098
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000f0d5
mov rcx, qword [rbx + 0x258]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14000f0bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000f0d5
mov rcx, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x248]
mov r9, qword [rcx]
mov r8, rdx
call qword [r9 + 0xa0]
mov rcx, qword [rbx + 0x258]
cmp rcx, 0xffffffffffffffff
je 0x14000f0f0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 0x258], 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x14000fea0
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x50
and qword [rax - 0x20], 0
mov ebp, 0x44
mov r13, rdx
mov r14, rcx
lea edx, [rbp - 0x43]
mov rcx, rbp
mov r12, r8
mov dword [rax - 0x28], ebp
mov dword [rax + 0x20], 0xff
call fcn.14001f100
mov rdi, rax
test rax, rax
jne 0x14000fef3
mov ebx, 0x8007000e
jmp 0x140010014
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x48]
call fcn.1400101dc
mov ebx, eax
test eax, eax
js 0x140010014
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14001000c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000fffa
cmp dword [rsp + 0x40], ebp
jbe 0x14000ff97
mov edx, dword [rsp + 0x40]
lea r8d, [rax - 0x79]
mov rcx, rdi
call fcn.14001f134
mov rbp, rax
test rax, rax
jne 0x14000ff94
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010014
mov rdi, rbp
cmp dword [rsp + 0x88], 0xff
jbe 0x14000ffbb
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x48]
call fcn.1400101dc
mov ebx, eax
test eax, eax
js 0x140010014
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14001000c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010014
mov qword [r12], rdi
xor edi, edi
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140010023
call fcn.140010338
test rdi, rdi
je 0x140010030
mov rcx, rdi
call fcn.14001f178
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140010050
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [rdx + 8]
and qword [r11 + 0x18], 0
and dword [rsp + 0x78], 0
mov rdi, rcx
test rax, rax
je 0x140010086
lea r8, [r11 + 0x18]
mov rdx, rax
xor ecx, ecx
call fcn.14000fea0
mov ebx, eax
test eax, eax
jmp 0x1400100ec
mov r9d, dword [rdx + 0x1c]
mov r8d, dword [rdx + 0x18]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov eax, dword [rdx + 0x34]
lea rcx, [rdx + 0x10]
mov dword [rsp + 0x48], eax
mov eax, dword [rdx + 0x30]
mov dword [rsp + 0x40], eax
mov eax, dword [rdx + 0x2c]
mov dword [rsp + 0x38], eax
mov eax, dword [rdx + 0x28]
mov dword [rsp + 0x30], eax
mov eax, dword [rdx + 0x24]
mov dword [rsp + 0x28], eax
mov eax, dword [rdx + 0x20]
mov dl, byte [rdx + 0x16]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1400100ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010129
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140010120
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010129
xor ebx, ebx
cmp dword [rsp + 0x78], ebx
sete bl
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14001013c
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x1400108c8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rdx], 0
mov rbx, rdx
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400108fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x140010905
mov rax, qword [rsp + 0x38]
xor ecx, ecx
mov qword [rbx], rax
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140010910
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbp, rdx
mov rdi, rcx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x1400109d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400109d0
movzx eax, word [rdi]
xor edx, edx
mov rcx, rdi
cmp ax, dx
je 0x1400109cb
lea r8d, [rsi + 0x5c]
cmp ax, r8w
cmove rsi, rcx
add rcx, 2
mov ax, word [rcx]
cmp ax, dx
jne 0x14001095e
cmp rsi, rdx
je 0x1400109cb
mov word [rsi], dx
mov rcx, rdi
mov rdx, rbp
call fcn.140010910
mov ebx, eax
mov eax, 0x5c
mov word [rsi], ax
test ebx, ebx
js 0x1400109d0
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400109c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400109b7
mov ebx, 1
jmp 0x1400109d0
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400109d0
xor ebx, ebx
jmp 0x1400109d0
mov ebx, 0x80070003
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140010b24
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010b9c
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9, rdi
xor r8d, r8d
mov rcx, rax
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x140010b7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
test eax, eax
je 0x140010b9c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140010c48
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
mov r13, rdx
lea rdx, [rax + 0x20]
and dword [rax + 0x20], ebx
and qword [rax - 0x20], rbx
and dword [rax - 0x28], ebx
mov r12, r8
mov rbp, rcx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
jne 0x140010ca0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010d3e
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x140010cba
mov ebx, 0x8007000e
jmp 0x140010d30
mov edx, dword [rsp + 0x68]
mov r9, rax
mov r8d, esi
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x140010ce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010d30
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140020d30]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x140010d1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010d30
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rdx + 8]
mov dword [r13], ecx
mov ecx, dword [rdx + 0xc]
mov dword [r12], ecx
test rdi, rdi
je 0x140010d3e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x140010d5c
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
cmp r9d, ebx
je 0x140010db3
mov rdx, rcx
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
cmp eax, ebx
jne 0x140010da1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
mov ebx, ecx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, ebx
cmp edi, ebx
sete r8b
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebx
jne 0x140010da1
cmp edi, ebx
jne 0x140010d8b
xor edx, edx
mov rcx, rsi
call fcn.14001082c
cmp eax, ebx
je 0x140010d8b
mov ebx, 1
jmp 0x140010da1