joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cb780
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rcx + 0x28], 7
xor r14d, r14d
mov qword [rcx + 0x20], r14
mov word [rcx + 0x10], r14w
add rcx, 0x438
lea rdx, str.SynCom.PointingDevice
call fcn.14002e3d0
lea rax, vtable.CDummySynDevice.0
mov qword [rsi + 0x450], rax
mov dword [rsi + 0x458], r14d
mov qword [rsi + 0x448], r14
lea rax, vtable.SynDeviceEx.0
mov qword [rsi + 0x430], rax
lea rax, vtable.SynDeviceEx.1.0
mov qword [rsi + 0x440], rax
mov dword [rsi + 0x460], 0xffffffff
mov dword [rsi + 0x464], r14d
lea rcx, [rsi + 0x480]
call fcn.1400e2d20
nop
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov dword [rsi + 0x470], 0x800
mov qword [rsi + 0x468], r14
mov qword [rsi + 0x478], r14
mov dword [rsi + 0x474], 1
lea rdi, [rsi + 0x4a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r14 + 0x26]
lea rcx, [rsi + 0x480]
call fcn.1400e2e10
test eax, eax
jns 0x1400cb8d4
lea rcx, str.ProgramFiles
call fcn.1400ef4a8
test rax, rax
je 0x1400cb8b2
lea rcx, str.ProgramFiles
call fcn.1400ef4a8
mov rdx, rdi
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400cb8a0
jmp 0x1400cb8d4
lea rcx, str.C:Program_Files
mov rdx, rsi
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rdx + rcx + 0x4a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400cb8c0
lea rbx, [rsi + 0x6a8]
mov r8, rdi
lea rdx, str._sSynapticsSynTP
mov rcx, rbx
call fcn.1400e7a7c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400cb909
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call fcn.1400dd570
cmp eax, 9
jl 0x1400cb93f
lea rax, [rsi + 0x8b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 5]
lea rcx, [rsi + 0x480]
call fcn.1400e2e10
test eax, eax
jns 0x1400cb960
lea rcx, [rsi + 0x8b0]
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400cb950
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400cf200
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov word [r11 - 0x78], r15w
xor eax, eax
mov qword [r11 - 0x76], rax
mov qword [r11 - 0x6e], rax
mov qword [r11 - 0x66], rax
mov qword [r11 - 0x5e], rax
mov qword [r11 - 0x56], rax
mov qword [r11 - 0x4e], rax
mov qword [r11 - 0x46], rax
mov word [rsp + 0x7a], ax
cmp qword [rdx + 0x18], 8
jb 0x1400cf260
mov rcx, qword [rdx]
jmp 0x1400cf263
mov rcx, rdx
lea rdx, [rsp + 0xc0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1400cf320
mov eax, 2
mul rbp
cmovo rax, rbx
mov rcx, rax
call fcn.1400e4e54
mov r14, rax
cmp qword [rdi + 0x18], 8
jb 0x1400cf2a1
mov rcx, qword [rdi]
jmp 0x1400cf2a4
mov rcx, rdi
mov r9, rax
mov r8d, ebp
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400cf318
mov qword [rsp + 0xd8], r15
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
lea rdx, [0x140124f70]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400cf318
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1400cf318
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.v_d._d._d._d
lea rcx, [rsp + 0x40]
call fcn.1400e7a7c
mov rcx, r14
call fcn.1400e5d34
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
cmp word [rsp + 0x40], 0
jne 0x1400cf33d
mov rbx, r15
jmp 0x1400cf34c
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400cf342
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140007720
nop
cmp qword [rdi + 0x18], 8
jb 0x1400cf36c
mov rcx, qword [rdi]
call fcn.1400e5d34
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d04d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
test rax, rax
je 0x1400d05a7
movzx r8d, word [rax]
mov qword [rsp + 0x30], rbx
mov rbx, rax
test r8w, r8w
je 0x1400d0550
nop dword [rax]
lea rdx, [0x14013eee0]
movzx r8d, r8w
mov rcx, rdi
call fcn.1400ed9cc
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400d0510
lea rdx, [0x1401327f4]
mov rcx, rdi
call fcn.1400ed9cc
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400d0510
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rbp + 0x438]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x1400d0584
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x100001d2
call qword [rax + 0x18]
mov eax, dword [rsp + 0x40]
lea rcx, [0x14013e248]
test eax, eax
lea r8, [0x14013e250]
cmovne r8, rcx
lea rdx, str.IsUserAdmin_s_n
mov rcx, rdi
call fcn.1400ed9cc
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d05c0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2020
call fcn.1400e75f0
sub rsp, rax
mov rbp, r8
mov rsi, rdx
xor edi, edi
nop word [rax + rax]
lea rdx, [0x140139fb8]
mov rcx, rbp
call fcn.1400eda60
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400d0624
test rbx, rbx
jne 0x1400d063f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jl 0x1400d05f0
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call fcn.1400ed350
test eax, eax
jne 0x1400d068c
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400ed378
test eax, eax
jne 0x1400d068c
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.1400ed850
test rax, rax
je 0x1400d068c
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400ed918
mov rcx, rbx
call fcn.1400ed350
test eax, eax
je 0x1400d0650
mov rcx, rsi
call fcn.1400ebca8
mov rcx, rbx
call fcn.1400ebb6c
mov eax, 1
jmp 0x1400d0626
Function at 0x1400d2b10
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
cmp dword [0x140272c10], 0
jne 0x1400d2d01
mov dword [0x140272c10], 1
call fcn.1400df0d0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea edx, [rcx + 0x2a]
jne 0x1400d2b62
lea edx, [rcx + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.140004f70
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400d2b87
mov ecx, 0x80004005
call fcn.140004f20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x1400d2bd8
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.14000b790
test rax, rax
je 0x1400d2c00
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.14000bc20
jmp 0x1400d2c00
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d2be0
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.14000be20
nop
lea r8, str.LenovoMetricCollectionSDKMFCLenovo.MetricCollectionMFC.dll
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x288]
call fcn.140079580
nop
mov rdx, qword [rsp + 0x280]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400d2c39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140272be0], rax
test rax, rax
je 0x1400d2ce5
lea rdx, str.GetMetricCollectionCollector
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400d2ce5
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400e0d20
mov byte [rsp + 0x48], 1
lea rax, str.SynapticsAppsCollectionReport
mov qword [rsp + 0x40], rax
lea rax, str.Local_Todo
mov qword [rsp + 0x38], rax
lea rax, str.Countyr_Todo
mov qword [rsp + 0x30], rax
lea rax, str.Family_Todo
mov qword [rsp + 0x28], rax
lea rax, str.SubBrand_Todo
mov qword [rsp + 0x20], rax
lea r9, str.Brand_Todo
lea r8, str.MTM_Todo
lea rdx, str.19.0.19.65
lea rcx, [rsp + 0x60]
call rdi
mov qword [0x140272bd8], rax
mov rdx, qword [rsp + 0x288]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400d2d01
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x140272bd8]
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x1400d87f0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x670
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x698], rbx
mov rdi, rcx
lea rax, vtable.CSynDeviceGestureActionService.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rbx, [rcx + 0x18]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.1400d93e0
mov qword [rbx], rax
mov dword [rsp + 0x688], 0x101
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x58]
test rcx, rcx
jne 0x1400d8866
lea rcx, [rax + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x690]
mov edx, 0x10000101
call qword [rax + 0x18]
or ecx, 0xffffffff
test eax, eax
cmove ecx, dword [rsp + 0x690]
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x60]
lea r8, str..pipe_sC01BC476_A852_4dfd_B33F_E308F3497BF4_li
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400e7b40
lea r9, [0x140124f70]
lea r8, [0x140132220]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400de860
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rsp + 0x48], 8
jb 0x1400d88dc
mov rcx, qword [rsp + 0x30]
call fcn.1400e5d34
test bl, bl
je 0x1400d893c
lea r9, [0x140124f70]
lea r8, [0x140132220]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400de860
cmp qword [rax + 0x18], 8
jb 0x1400d8904
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x270]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400e7b40
cmp qword [rsp + 0x48], 8
jb 0x1400d893c
mov rcx, qword [rsp + 0x30]
call fcn.1400e5d34
mov edx, 0x3d
lea rcx, [rsp + 0x270]
call fcn.140002990
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400d8963
mov rdx, rdi
mov rcx, rax
call fcn.140002740
nop
mov rax, rdi
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret
Function at 0x1400dc630
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rbx, rcx
xor r15d, r15d
xor ecx, ecx
mov r14, r9
mov ebp, r8d
mov rsi, rdx
mov edi, r15d
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x1400dc84c
lea rax, [rsp + 0x30]
lea r9, [0x140142d50]
lea r8d, [r15 + 1]
lea rcx, [0x140142dc0]
xor edx, edx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400dc846
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [0x140142db0]
call qword [rax]
test eax, eax
js 0x1400dc83b
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x1400dc830
mov rax, qword [rsp + 0x30]
mov rbx, qword [rax]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
cmp dword [rsp + 0x2f0], r15d
je 0x1400dc7b1
lea r8d, [r15 + 4]
call qword [rbx + 0x98]
test eax, eax
jne 0x1400dc830
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rax, qword [rcx]
mov rdx, rsi
mov dword [rsp + 0x20], r15d
call qword [rax + 0x18]
test eax, eax
jne 0x1400dc73b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 1]
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x2d0]
mov rdx, r14
mov rax, qword [rcx]
mov r8d, ebx
call qword [rax + 0x40]
test eax, eax
je 0x1400dc75f
test ebx, ebx
jle 0x1400dc75f
mov word [r14], r15w
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2d8]
mov rax, qword [rcx]
mov r8d, ebx
mov rdx, rsi
call qword [rax + 0x50]
test eax, eax
je 0x1400dc78b
test ebx, ebx
jle 0x1400dc78b
mov word [rsi], r15w
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x2e8]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x70]
test eax, eax
je 0x1400dc830
mov dword [rbx], 5
jmp 0x1400dc830
mov r8d, 0x39
call qword [rbx + 0x98]
test eax, eax
js 0x1400dc830
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rax, qword [rcx]
mov rdx, rsi
mov dword [rsp + 0x20], r15d
call qword [rax + 0x18]
test eax, eax
jne 0x1400dc7ec
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 1]
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x2d0]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x2e0]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x2d8]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x2e8]
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r11, [rsp + 0x290]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400dd080
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov edx, eax
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test rdi, rdi
je 0x1400dd0dd
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, ebp
mov edx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400dd110
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x250], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov eax, dword [0x140272cb8]
test al, 1
jne 0x1400dd182
or eax, 1
mov dword [0x140272cb8], eax
mov qword [0x140272cb0], 7
mov qword [0x140272ca8], rdi
mov word [0x140272c98], di
xor r8d, r8d
lea rdx, [0x1401246c4]
lea rcx, [0x140272c98]
call fcn.140007720
lea rcx, [0x1401222a0]
call fcn.1400e6f90
nop
cmp dword [0x140272c94], 0
jne 0x1400dd1e6
mov r9d, 1
lea r8d, [r9 + 0x22]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], 0
jne 0x1400dd1af
mov r8, rdi
jmp 0x1400dd1cb
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400dd1c0
lea rdx, [rsp + 0x30]
lea rcx, [0x140272c98]
call fcn.140007720
mov dword [0x140272c94], 1
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x140272c98]
mov rcx, rbx
call fcn.1400075d0
mov rax, rbx
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x1400dd220
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rsi, rcx
mov dword [rcx], 1
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.1400e5f00
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x270], 0x104
mov qword [rsp + 0x278], rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400dd353
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x250], rdi
call fcn.1400519c0
cmp qword [rax + 0x18], 8
jb 0x1400dd29b
mov rax, qword [rax]
lea r9, [rsp + 0x278]
mov r8d, 1
mov rdx, rax
xor ecx, ecx
call sub.NETAPI32.dll_NetUserGetInfo
cmp qword [rsp + 0x38], 8
mov edi, eax
jb 0x1400dd2c7
mov rcx, qword [rsp + 0x20]
call fcn.1400e5d34
test edi, edi
je 0x1400dd32f
lea r8, [rsp + 0x280]
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x280], rbx
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov edi, eax
test eax, eax
jne 0x1400dd30f
mov rcx, qword [rsp + 0x280]
lea r9, [rsp + 0x278]
lea r8d, [rax + 1]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x18]
call sub.NETAPI32.dll_NetUserGetInfo
mov edi, eax
mov rcx, qword [rsp + 0x280]
test rcx, rcx
je 0x1400dd321
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x1400dd32f
mov rcx, qword [rsp + 0x278]
jmp 0x1400dd341
mov rcx, qword [rsp + 0x278]
mov ebx, 1
mov eax, dword [rcx + 0x14]
mov dword [rsi], eax
mov rdi, qword [rsp + 0x250]
test rcx, rcx
je 0x1400dd353
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, ebx
add rsp, 0x258
pop rsi
pop rbx
ret

Function at 0x1400dd3a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x260
mov edi, ecx
mov r14, rdx
xor esi, esi
lea ecx, [rsi + 2]
xor edx, edx
mov ebp, r8d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp + 0x20], 0x238
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400dd42a
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400dd421
cmp dword [rsp + 0x28], edi
je 0x1400dd40c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400dd3f3
jmp 0x1400dd421
lea r8, [rsp + 0x4c]
mov rdx, rbp
mov rcx, r14
call fcn.1400e7694
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400ded60
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x430
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, rdx
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov eax, dword [0x140272d20]
test al, 1
jne 0x1400dedd7
or eax, 1
mov dword [0x140272d20], eax
mov qword [0x140272d18], 7
mov qword [0x140272d10], rsi
mov word [0x140272d00], si
xor r8d, r8d
lea rdx, [0x1401246c4]
lea rcx, [0x140272d00]
call fcn.140007720
lea rcx, [0x140122380]
call fcn.1400e6f90
nop
mov r8d, 0x200
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x30], 0
jne 0x1400dedf8
mov r8, rsi
jmp 0x1400dee0c
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400dee01
lea rdx, [rsp + 0x30]
lea rcx, [0x140272d00]
call fcn.140007720
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x140272d00]
mov rcx, rbx
call fcn.1400075d0
mov rax, rbx
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400df170
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
sub rsp, 0x468
cmp dword [0x140272c8c], 0
jne 0x1400df29e
mov qword [rax - 8], rbx
xor ebx, ebx
mov word [rax + 0x14], 0x500
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], rbx
mov dword [rax + 0x10], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x488]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400df296
mov rcx, qword [rsp + 0x488]
lea rax, [rsp + 0x470]
lea r8, [rsp + 0x60]
lea edx, [rbx + 2]
mov r9d, 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400df288
lea rax, [rsp + 0x480]
lea r8d, [rbx + 0x20]
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400df288
cmp dword [rsp + 0x60], ebx
jbe 0x1400df270
nop word [rax + rax]
mov rcx, qword [rsp + 0x480]
mov edx, ebx
add rdx, rdx
mov rdx, qword [rsp + rdx*8 + 0x68]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400df266
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x1400df240
jmp 0x1400df270
mov dword [0x140272c90], 1
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [0x140272c8c], 1
mov rcx, qword [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x460]
mov eax, dword [0x140272c90]
add rsp, 0x468
ret
Function at 0x1400df7d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x1400df858
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400df858
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400df858
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400df858
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret