joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180036320
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x180072040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x180072aa0]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18003653e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18003653e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x180072aa0]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x1800363f4
movsx rdx, word [r8 + 0x60f0]
lea rax, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x1800363e9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60f4]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60e8]
test rdi, rdi
je 0x180036411
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x180036414
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x180067ff8]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x180036457
mov rsi, qword [r8 + 0x90]
jmp 0x18003645a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180036485
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x180072aa0]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x1800364fe
inc rbx
cmp rbx, 5
jl 0x1800364e0
jmp 0x18003652a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x180036540
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18005d4c0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x18004ebe0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x18004ec6c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18004ec40
lea r11, [0x180060b20]
nop
cmp r9b, 0x23
jne 0x18004ec23
cmp byte [r8], r9b
jne 0x18004ec23
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18004ec10
mov rcx, qword [0x180072aa0]
not eax
cmp dword [rcx + 0x4064], eax
jne 0x18004ec57
mov dword [rcx + 0x4068], eax
cmp dword [rcx + 0x4094], eax
jne 0x18004ecc9
mov byte [rcx + 0x4098], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180072aa0]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4000]
movsxd rax, dword [rbx + 0x100]
mov r8, qword [rbx + 0x108]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.180004420
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x404c], eax
jne 0x18004ecc2
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.18001e560
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180059cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180059f20
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180059dea
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180059d34
mov rax, qword [0x180072008]
cmp qword [rsp + 0x20], rax
ja 0x180059d34
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180059cf6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180059d65
jmp 0x180059dea
cmp dword [rsp + 0x50], 0x10000
jne 0x180059dcd
cmp qword [rsp + 0x48], 0x10000
jb 0x180059dcd
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180059dab
mov rax, qword [rsp + 0x28]
jmp 0x180059dec
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180059dbb
xor eax, eax
jmp 0x180059dec
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180059de5
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180059f20
mov qword [rsp + 0x20], rax
jmp 0x180059cf6
xor eax, eax
add rsp, 0x68
ret

Function at 0x180059e00
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180059f60
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180059f16
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180059e5b
mov rax, qword [0x180072008]
cmp qword [rsp + 0x20], rax
ja 0x180059e5b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180059e1d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180059e8c
jmp 0x180059f16
cmp dword [rsp + 0x50], 0x10000
jne 0x180059ef4
cmp qword [rsp + 0x48], 0x10000
jb 0x180059ef4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180059ed2
mov rax, qword [rsp + 0x28]
jmp 0x180059f18
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180059ee2
xor eax, eax
jmp 0x180059f18
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180059f11
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180059f60
mov qword [rsp + 0x20], rax
jmp 0x180059e1d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180059fb0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18005a540
mov qword [rsp + 0x28], 0
cmp qword [0x180072458], 0
jne 0x180059ff8
cmp qword [0x180072450], 0
je 0x180059ff8
mov rax, qword [0x180072450]
mov qword [0x180072458], rax
cmp qword [0x180072458], 0
je 0x18005a09e
mov rax, qword [0x180072458]
cmp qword [rax + 0x10], 0
je 0x18005a09e
mov rax, qword [0x180072458]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18005a09e
mov rax, qword [0x180072458]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18005a09e
mov rax, qword [0x180072458]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18005a064
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18005a06b
xor eax, eax
jmp 0x18005a219
mov rax, qword [0x180072458]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18005a219
mov rax, qword [0x180072450]
mov qword [0x180072458], rax
jmp 0x18005a0c0
mov rax, qword [0x180072458]
mov rax, qword [rax + 8]
mov qword [0x180072458], rax
cmp qword [0x180072458], 0
je 0x18005a10d
cmp qword [0x180072458], 0
je 0x18005a10b
mov rax, qword [0x180072458]
cmp qword [rax + 0x10], 0
je 0x18005a10b
mov rax, qword [0x180072458]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18005a10b
mov rax, qword [0x180072458]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18005a10b
jmp 0x18005a03c
jmp 0x18005a0ae
mov rcx, qword [rsp + 0x60]
call fcn.18005c0a0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18005a220
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18005a217
mov rax, qword [rsp + 0x48]
mov qword [0x180072458], rax
mov rax, qword [0x180072458]
mov dword [rax], 0x52727464
mov rax, qword [0x180072458]
mov qword [rax + 0x10], 0
mov rax, qword [0x180072458]
mov rcx, qword [0x180072450]
mov qword [rax + 8], rcx
mov rax, qword [0x180072458]
mov qword [0x180072450], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180072458]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18005a1c8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18005a202
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18005a1be
mov rax, qword [0x180072458]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18005a03c
xor eax, eax
add rsp, 0x58
ret
Function at 0x18005af30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18005af77
xor al, al
jmp 0x18005b019
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18005afa1
xor al, al
jmp 0x18005b019
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x18005b011
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x18005b011
mov al, 1
jmp 0x18005b019
jmp 0x18005b017
xor al, al
add rsp, 0x78
ret

Function at 0x18005b320
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180072450]
mov qword [rsp + 0x28], rax
jmp 0x18005b340
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18005b36f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18005b36d
call sub.KERNEL32.dll_GetLastError
jmp 0x18005b371
jmp 0x18005b332
xor eax, eax
add rsp, 0x38
ret
Function at 0x18005ba30
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x180072468], eax
je 0x18005ba4b
mov eax, 0x10dd
jmp 0x18005bb70
mov rax, qword [0x180072480]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18005baf5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x18005bac0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x18005bac0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.18005a680
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.18005d4e0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18005ba57
mov qword [0x180072480], 0
call fcn.18005b0e0
mov rax, qword [0x180072478]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18005bb59
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.18005d4e0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18005bb11
mov qword [0x180072478], 0
mov dword [0x180072468], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x1400018c0
Capabilities:
Manipulate user privileges

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
test rcx, rcx
jne 0x1400018d6
xor eax, eax
add rsp, 0x50
pop rsi
ret
lea rcx, [rsp + 0x68]
call fcn.140001000
test eax, eax
je 0x1400018ef
mov eax, 1
add rsp, 0x50
pop rsi
ret
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140001100
test eax, eax
je 0x14000191a
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov eax, 2
add rsp, 0x50
pop rsi
ret
mov qword [rsp + 0x40], rbp
mov rbp, qword [rsp + 0x78]
mov rcx, rbp
call fcn.140001080
test rax, rax
je 0x14000194b
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov rbp, qword [rsp + 0x40]
mov eax, 3
add rsp, 0x50
pop rsi
ret
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
lea rdi, str.SeServiceLogonRight
xor eax, eax
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x60]
repne scasw ax, word [rdi]
lea r8, [rsp + 0x70]
mov rdx, rbp
not rcx
mov dword [rsp + 0x60], 0xffffffff
dec rcx
add cx, cx
mov word [rsp + 0x20], cx
add cx, 2
mov word [rsp + 0x22], cx
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
je 0x1400019f8
mov ecx, eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov edi, eax
cmp eax, 2
je 0x1400019f8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov ecx, edi
call fcn.140006fd0
mov rdi, rax
call fcn.140019be0
mov r9, rdi
lea rcx, [rax + 0x60]
mov r8, rsi
mov edx, 0x40000209
call fcn.140007250
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov eax, 4
add rsp, 0x50
pop rsi
ret
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x48], rbx
xor ebx, ebx
test ecx, ecx
je 0x140001a48
mov rdi, rbx
nop word [rax + rax]
mov r9, qword [rsp + 0x70]
movzx eax, word [rsp + 0x20]
cmp word [rdi + r9], ax
jne 0x140001a3e
movzx r8d, word [rsp + 0x22]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdi + r9 + 8]
call fcn.14001a3cc
test eax, eax
je 0x140001ab1
mov ecx, dword [rsp + 0x60]
inc ebx
add rdi, 0x10
cmp ebx, ecx
jb 0x140001a10
mov rcx, qword [rsp + 0x70]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x20]
mov r9d, 1
mov rdx, rbp
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, rbp
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
test edi, edi
je 0x140001ad0
mov ecx, edi
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov ecx, eax
call fcn.140006fd0
mov rdi, rax
call fcn.140019be0
mov r8, rdi
lea rcx, [rax + 0x60]
mov edx, 0x4000020a
call fcn.140007250
mov eax, 5
jmp 0x140001ae8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x70]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
jmp 0x140001ae6
call fcn.140019be0
mov r8, rsi
mov edx, 0x40000204
lea rcx, [rax + 0x30]
call fcn.140007250
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x50
pop rsi
ret
Function at 0x140006b90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
jne 0x140006be9
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.140006fd0
mov r8, rsi
mov edx, 0xc00003fe
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.140007190
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rbx, rdi
add rbx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140006c45
lea eax, [rbx + 1]
lea r9, str.expand_environment_string
lea r8, str.ExpandEnvironmentStrings__
mov edx, 0xc00003eb
movzx ecx, ax
mov qword [rsp + 0x20], rbx
call fcn.140007190
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140006cac
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.140006fd0
mov r8, rsi
mov edx, 0xc00003fe
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.140007190
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140006cc0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
movzx r12d, dl
mov rsi, rcx
mov edi, r13d
cmp word [rcx], di
je 0x140006db3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
nop
mov rbx, rsi
cmp word [rsi], r13w
je 0x140006d10
nop dword [rax]
cmp word [rbx], 0x3d
je 0x140006d1a
add rbx, 2
cmp word [rbx], r13w
jne 0x140006d00
cmp word [rbx], 0x3d
jne 0x140006d9a
mov word [rbx], r13w
test r12b, r12b
je 0x140006d73
add rbx, 2
mov rcx, rbx
call fcn.140006b90
mov rbp, rax
test rax, rax
je 0x140006d5f
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d49
inc edi
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_HeapFree]
jmp 0x140006d84
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d84
inc edi
jmp 0x140006d84
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d84
inc edi
add rbx, 2
cmp word [rbx], r13w
je 0x140006d9a
nop
add rbx, 2
cmp word [rbx], r13w
jne 0x140006d90
cmp word [rbx + 2], r13w
lea rsi, [rbx + 2]
jne 0x140006cf0
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
xor edx, edx
jmp 0x140006cc0
Function at 0x140006de0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
movzx r12d, dl
mov rsi, rcx
mov edi, r13d
cmp word [rcx], di
je 0x140006db3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
nop
mov rbx, rsi
cmp word [rsi], r13w
je 0x140006d10
nop dword [rax]
cmp word [rbx], 0x3d
je 0x140006d1a
add rbx, 2
cmp word [rbx], r13w
jne 0x140006d00
cmp word [rbx], 0x3d
jne 0x140006d9a
mov word [rbx], r13w
test r12b, r12b
je 0x140006d73
add rbx, 2
mov rcx, rbx
call fcn.140006b90
mov rbp, rax
test rax, rax
je 0x140006d5f
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d49
inc edi
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_HeapFree]
jmp 0x140006d84
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d84
inc edi
jmp 0x140006d84
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d84
inc edi
add rbx, 2
cmp word [rbx], r13w
je 0x140006d9a
nop
add rbx, 2
cmp word [rbx], r13w
jne 0x140006d90
cmp word [rbx + 2], r13w
lea rsi, [rbx + 2]
jne 0x140006cf0
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
xor edx, edx
jmp 0x140006cc0

Function at 0x140006df0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov rcx, rax
mov rdi, rax
call fcn.140006b50
mov rcx, rax
call fcn.140006de0
mov ebx, eax
test rdi, rdi
je 0x140006e25
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006e70
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rbx, rcx
call fcn.14000e3f0
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.14001a4c0
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x404
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x140006f12
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
xor eax, eax
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rbx, qword [rsp + 0xf0]
or ecx, 0xffffffff
cmp eax, 0x57
mov edx, 1
cmove ecx, edx
mov eax, ecx
add rsp, 0xe0
pop rdi
ret