joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020794
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebp, ebp
mov rsi, rdx
mov qword [rdx], rbp
mov rdi, rcx
mov ebx, 0x80070057
test rcx, rcx
je 0x14002083f
cmp word [rcx], bp
je 0x14002083f
lea rcx, [rsp + 0x80]
call fcn.14002086c
mov ebx, dword [rsp + 0x220]
test ebx, ebx
js 0x140020830
xor edx, edx
mov qword [rsp + 0x40], rbp
lea r8d, [rbp + 0x2c]
lea rcx, [rsp + 0x4c]
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x40]
mov qword [rsp + 0x48], 4
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
je 0x14003b25c
cmp eax, 0x2af9
jne 0x14003b2c9
lea ebx, [rbp + 1]
cmp dword [rsp + 0x220], ebp
jne 0x14002083f
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140024ca0
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.140069980
test eax, eax
js 0x14003b2b7
mov ecx, 0x804
call fcn.140024914
mov rbx, rax
test rax, rax
je 0x14003b2b7
mov rcx, qword [rsp + 0x40]
mov r9d, 0x401
mov dword [rsp + 0x30], 2
mov r8, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
mov edx, dword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.WS2_32.dll_GetNameInfoW]
test eax, eax
jne 0x14003b2af
mov qword [rsi], rbx
jmp 0x14003b2b7
mov rcx, rbx
call fcn.140024954
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov ebx, ebp
jmp 0x140020830
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
test eax, eax
jle 0x140020830
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140020830

Function at 0x14002086c
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx], 0x54535357
lea rdx, [rcx + 8]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jg 0x14003b2e8
mov dword [rbx + 0x1a0], eax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
movzx eax, ax
or eax, 0x80070000
jmp 0x140020892
Function at 0x140020a58
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionPrint
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020aed
and qword [rsp + 0x28], 0
lea rdx, str.DebugStartup
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x14003b2f6
xor bl, bl
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x140020ada
test byte [rcx + 0x44], 0x80
jne 0x14003b320
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test bl, bl
jne 0x14003b33b
add rsp, 0x30
pop rbx
ret
mov bl, 1
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x140020ada
test byte [rcx + 0x44], 0x80
je 0x140020ada
mov edx, 0xd
jmp 0x14003b325
mov edx, 0xe
mov rcx, qword [rcx + 0x38]
lea r8, [0x140093e20]
call fcn.14003d1bc
nop
jmp 0x140020ada
mov ecx, 1
call fcn.14001bf84
mov ecx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
test eax, eax
je 0x14003b33b
jmp 0x140020aed

Function at 0x140020e88
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x460
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ebp, ebp
mov rdi, rcx
mov rbx, rdx
mov ecx, 0x80070057
test rdx, rdx
je 0x140020f3d
xor edx, edx
mov word [rsp + 0x40], bp
mov r8d, 0x40e
lea rcx, [rsp + 0x42]
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x140073590]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x40e
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x140032198
lea edx, [rbp + 0x2c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x140020f28
mov word [rax], bp
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
mov ecx, ebp
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140024ca0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
jle 0x140020f3d
movzx ecx, ax
or ecx, 0x80070000
jmp 0x140020f3d
Function at 0x140020f70
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rbp + 0x150], rax
cmp dword [rbp + 0x1b0], 0
mov r14, r9
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
jne 0x1400321ac
xor r15d, r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], r15
and qword [rsp + 0x28], r15
and qword [rsp + 0x20], r15
xor edx, edx
jmp 0x14002100d
mov r9, rsi
mov dword [rsp + 0x20], ebx
mov r8, rdi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sym.spoolsv.exe_PrvUpdatePrinterRegUser
inc r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov edx, r15d
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0x100
lea r8, [rsp + 0x50]
mov rcx, 0xffffffff80000003
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x14002107f
lea rdx, str..Default
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140020feb
mov edx, 0x5f
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x140020feb
test r14, r14
je 0x140020fd5
mov rdx, r14
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140020feb
jmp 0x140020fd5
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140024ca0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r9, rdx
mov dword [rsp + 0x20], ebx
mov r8, rcx
xor edx, edx
mov rcx, 0xffffffff80000001
call sym.spoolsv.exe_PrvUpdatePrinterRegUser
nop
jmp 0x14002107f
Function at 0x1400213d0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
and qword [rax + 0x10], 0
mov rbx, r8
and qword [rax + 0x20], 0
mov rdi, rdx
test rdx, rdx
je 0x14003466a
lea r9, [rax + 0x20]
lea r8, [rax + 0x10]
call fcn.140021308
test eax, eax
je 0x14003469c
mov rdx, qword [rsp + 0x58]
test rbx, rbx
jne 0x1400346a3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov ebx, eax
cmp eax, 2
jne 0x14002142c
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x1400346f0
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
jmp 0x14003469c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x1400a92b0]
lea r8, [0x140075fe0]
mov r9d, eax
mov edx, 0xa
mov rcx, qword [rcx + 0x10]
call fcn.14003d1e0
xor eax, eax
jmp 0x140021442
movzx ecx, word [rbx + 0x46]
mov r9d, 3
movzx eax, word [rbx + 0x44]
xor r8d, r8d
add ecx, eax
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14002142c
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea ecx, [rax + 2]
lea r8d, [rax + 0x1b]
call sym.spoolsv.exe_PrvRouterBroadcastMessage
nop
jmp 0x14002142c
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rax, qword [0x1400a92b0]
lea rcx, [0x1400a92b0]
cmp rax, rcx
je 0x14003469c
test byte [rax + 0x1c], 0x20
je 0x14003469c
jmp 0x140034677
Function at 0x140022d8c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [0x1400a93a0], 0xffffffff
je 0x140022da7
mov eax, dword [0x1400a93a0]
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
lea rax, [rsp + 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov dword [0x1400a93a0], ebx
lea rdx, [0x1400758a0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022d9b
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.PrintIsolationDefault
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x14003c46e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x140022d9b
cmp dword [rsp + 0x40], ebx
setne bl
mov dword [0x1400a93a0], ebx
jmp 0x140022e1f
Function at 0x140024e3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140024e88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140024e80
cmp dword [rcx + 0x3c], edx
jl 0x140024e80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140024e80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140024e88
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14003d384
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
xor ebx, ebx
mov dword [rbp + 0x18], 4
lea rax, [rbp + 0x30]
mov qword [rbp + 0x30], rbx
mov r9d, 0x20019
mov dword [rbp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemWPAPrintServer
mov dword [rbp + 0x28], 4
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003d416
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.Disabled
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14003d40c
cmp dword [rbp + 0x18], 4
jne 0x14003d40c
lea eax, [rbx + 1]
cmp dword [rbp + 0x20], eax
cmove ebx, eax
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x140041b70
Capabilities:
Create thread

Disassembly:
test rcx, rcx
je 0x140041bda
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
cmp word [rcx], di
je 0x140041bd0
call sym.spoolsv.exe_PrvDllAllocSplStr
mov rbx, rax
test rax, rax
je 0x140041bd0
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1400402f0]
mov edx, 0x10000
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateThread]
test rax, rax
je 0x140041bc8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x140041bd0
mov rcx, rbx
call sym.spoolsv.exe_PrvDllFreeSplStr
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140043420
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, r9d
mov rbx, r8
mov esi, edx
mov rbp, rcx
test r8, r8
je 0x140043455
cmp qword [r8 + 8], 0
jne 0x140043455
mov eax, 0x57
jmp 0x140043505
mov ecx, dword [rsp + 0x60]
call fcn.14000e7b4
test eax, eax
je 0x1400434ff
mov ecx, dword [0x1400aa9c0]
mov edx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsSetValue]
test rbx, rbx
je 0x140043482
mov r9, qword [rbx + 8]
jmp 0x140043485
xor r9d, r9d
test rbx, rbx
je 0x14004348f
mov r8d, dword [rbx]
jmp 0x140043492
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], edi
mov rcx, rbp
call sym.spoolsv.exe_PrvSetJobW
mov ecx, dword [0x1400aa9c0]
xor edx, edx
mov ebx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsSetValue]
mov ecx, dword [rsp + 0x60]
call fcn.14000f64c
test ebx, ebx
je 0x1400434c1
xor eax, eax
jmp 0x140043505
mov rax, qword [0x1400a92b0]
lea rcx, [0x1400a92b0]
cmp rax, rcx
je 0x1400434ff
test byte [rax + 0x44], 1
je 0x1400434ff
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x1400a92b0]
lea r8, [0x140075e20]
mov r9d, eax
mov edx, 0xd
mov rcx, qword [rcx + 0x38]
call fcn.14003d1e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140043520
Capabilities:
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov esi, r9d
mov rcx, r8
mov rbx, r8
mov rbp, rdx
call fcn.14002374c
xor edi, edi
test eax, eax
jne 0x14004355d
mov eax, 0x57
jmp 0x14004360b
cmp dword [r8], 3
je 0x140043570
mov ecx, 0x7c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
jmp 0x140043553
mov ecx, r9d
call fcn.14000e7b4
test eax, eax
jne 0x140043587
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x14004360b
mov ecx, dword [0x1400aa9b0]
mov edx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsSetValue]
mov r9, qword [rbx + 8]
mov rdx, rbp
mov r8d, dword [rbx]
mov rcx, r14
call sym.spoolsv.exe_PrvSetPortW
mov ecx, dword [0x1400aa9b0]
xor edx, edx
mov ebx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsSetValue]
mov ecx, esi
call fcn.14000f64c
test ebx, ebx
jne 0x140043609
mov rax, qword [0x1400a92b0]
lea rcx, [0x1400a92b0]
cmp rax, rcx
je 0x140043601
test byte [rax + 0x44], 1
je 0x140043601
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x1400a92b0]
lea edx, [rbx + 0x46]
mov r9d, eax
lea r8, [0x140075e20]
mov rcx, qword [rcx + 0x38]
call fcn.14003d1e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140053b48
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x60
mov ebx, edx
mov edi, ecx
test edx, edx
jne 0x140053b67
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x140053b69
mov eax, edx
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x30]
and dword [rsp + 0x58], 0
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov dword [rsp + 0x30], eax
lea rcx, [0x140092d38]
mov qword [rsp + 0x38], 4
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], 4
call fcn.140022bfc
mov rcx, qword [0x1400a92b0]
lea rbp, [0x1400a92b0]
cmp rcx, rbp
je 0x140053bdb
test byte [rcx + 0x1c], 4
je 0x140053bdb
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075f20]
mov edx, 0x1f
mov dword [rsp + 0x20], ebx
mov r9d, edi
call fcn.140057a4c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
test eax, eax
jne 0x140053c59
mov rcx, qword [0x1400a92b0]
cmp rcx, rbp
je 0x140053c4e
test byte [rcx + 0x1c], 4
je 0x140053c2e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x1400a92b0]
lea r8, [0x140075f20]
mov r9d, eax
mov edx, 0x20
mov rcx, qword [rcx + 0x10]
call fcn.14003d1e0
mov rcx, qword [0x1400a92b0]
cmp rcx, rbp
je 0x140053c4e
test byte [rcx + 0x1c], 4
je 0x140053c4e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140075f20]
mov edx, 0x21
call fcn.14003d1bc
xor eax, eax
movabs byte [0], al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140054384
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
lea rdx, [rbp + 0x2b]
mov bl, dil
call qword [sym.imp.RPCRT4.dll_I_RpcBindingIsClientLocal]
test eax, eax
jne 0x14005445a
cmp dword [rbp + 0x2b], edi
je 0x14005445a
lea ebx, [rdi + 1]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThread]
lea r9, [rbp + 0x2f]
mov r8d, ebx
mov rcx, rax
lea edx, [rdi + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_OpenThreadToken]
test eax, eax
je 0x14005445a
lea rax, [rbp + 0x37]
mov dword [rbp + 0x3f], edi
mov qword [rsp + 0x50], rax
lea r8d, [rdi + 2]
mov dword [rsp + 0x48], edi
lea rcx, [rbp + 0x3f]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], edi
mov dl, bl
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov word [rbp + 0x43], 0x500
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140054450
mov rdx, qword [rbp + 0x37]
lea r8, [rbp + 0x27]
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_CheckTokenMembership]
test eax, eax
je 0x140054446
cmp dword [rbp + 0x27], edi
cmovne ebx, edi
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.api_ms_win_security_base_l1_2_0.dll_FreeSid]
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov al, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140024ca0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400545c8
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor r14d, r14d
mov r15, r8
cmp qword [0x1400ab190], r14
mov rbx, rcx
jne 0x140054614
mov eax, 0x80004005
jmp 0x140054806
mov r12, r14
mov r13b, r14b
mov edi, 1
test rcx, rcx
je 0x14005469e
mov rax, qword gs:[0x30]
cmp dword [rax + 0x179c], r14d
jne 0x140054652
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
test eax, eax
jle 0x14005464a
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140054652
mov r12, rbx
mov r13b, dil
mov rcx, rbx
call fcn.140054384
test al, al
je 0x14005469e
mov rcx, qword [0x1400a92b0]
lea rsi, [0x1400a92b0]
cmp rcx, rsi
je 0x1400547f6
mov r14d, 2
test byte [rcx + 0x1c], r14b
je 0x1400547f6
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 8]
lea r8, [0x14009cdc8]
call fcn.14003d1bc
jmp 0x1400547f6
mov esi, 0x2b0
lea rcx, [rsp + 0x30]
mov r8d, esi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], esi
lea rsi, [0x1400a92b0]
mov r14d, 2
movups xmm0, xmmword [0x140074c20]
movdqu xmmword [rsp + 0x34], xmm0
test r15, r15
je 0x1400546e8
mov r8, r15
lea rcx, [rbp - 0x28]
mov edx, 0x104
call fcn.14000ff60
jmp 0x140054742
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rdx, [rbp - 0x28]
mov ecx, r14d
call qword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
jne 0x140054742
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x140054718
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [0x1400a92b0]
cmp rcx, rsi
je 0x140054742
test byte [rcx + 0x1c], dil
je 0x140054742
mov rcx, qword [rcx + 0x10]
lea r8, [0x14009cdc8]
mov edx, 0xb
mov r9d, eax
call fcn.14003d1e0
lea rdx, [rbp + 0x1e0]
mov rcx, rbx
call fcn.1400541cc
mov ebx, eax
test eax, eax
js 0x14005476e
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1e0]
call fcn.14005431c
mov ebx, eax
test eax, eax
jns 0x1400547ad
mov rcx, qword [0x1400a92b0]
cmp rcx, rsi
je 0x140054798
test byte [rcx + 0x1c], r14b
je 0x140054798
mov rcx, qword [rcx + 0x10]
lea r8, [0x14009cdc8]
mov edx, 0xc
mov r9d, ebx
call fcn.14003d1e0
mov word [rsp + 0x58], r14w
xor r14d, r14d
mov dword [rsp + 0x5c], r14d
cmp word [rbp - 0x28], r14w
je 0x1400547f4
mov rbx, qword [0x1400ab190]
mov rcx, rbx
call qword [0x1400719c8]
lea rcx, [rsp + 0x30]
call rbx
mov ebx, eax
test eax, eax
jns 0x1400547f4
mov rcx, qword [0x1400a92b0]
cmp rcx, rsi
je 0x1400547f4
test byte [rcx + 0x1c], dil
je 0x1400547f4
mov rcx, qword [rcx + 0x10]
lea r8, [0x14009cdc8]
mov edx, 0xd
mov r9d, eax
call fcn.14003d1e0
mov edi, ebx
test r13b, r13b
je 0x140054804
mov rcx, r12
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
mov eax, edi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140024ca0
mov rbx, qword [rsp + 0x3c8]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005d014
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov r15, r9
mov r13, r8
mov r12d, edx
mov rdi, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rdi, rax
je 0x14005d082
test byte [rdi + 0x1c], 0x80
je 0x14005d082
mov rcx, qword [rdi + 0x10]
lea r8, [0x14009ce88]
mov edx, 0x1c
call fcn.14003d1bc
mov rdi, qword [0x1400a92b0]
or esi, 0xffffffff
mov dword [rsp + 0x40], 0x63726374
xor edx, edx
mov dword [rsp + 0x30], esi
mov r8d, 0x400
lea rcx, [rsp + 0x44]
call sub.msvcrt.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x44]
mov ecx, r9d
mov eax, ecx
mov r8d, 8
test al, 1
je 0x14005d0c3
shr eax, 1
xor eax, 0xedb88320
jmp 0x14005d0c5
shr eax, 1
sub r8, 1
jne 0x14005d0b6
mov dword [rdx], eax
inc ecx
add rdx, 4
cmp ecx, 0x100
jl 0x14005d0ae
mov dword [rbp + 0x344], r9d
test r15, r15
jne 0x14005d142
mov ebx, 0x80070057
lea rax, [0x1400a92b0]
cmp rdi, rax
je 0x14005d116
test byte [rdi + 0x1c], 0x20
je 0x14005d116
mov rcx, qword [rdi + 0x10]
lea r8, [0x14009ce88]
mov edx, 0x1d
mov r9d, ebx
call fcn.14003d1e0
mov eax, ebx
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140024ca0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, r9d
mov r14d, r9d
cmp r14d, r12d
jae 0x14005d1f4
test ebx, ebx
js 0x14005d1e9
lea rax, [rsp + 0x30]
mov r9d, 4
mov r8, r13
mov qword [rsp + 0x20], rax
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.140069e28
mov esi, dword [rsp + 0x30]
xor r9d, r9d
mov ebx, eax
test eax, eax
js 0x14005d1e9
mov r8, qword [r13 + 8]
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r9w
jne 0x14005d18d
lea r9d, [rax*2 + 2]
mov edx, esi
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140069e28
xor r9d, r9d
mov ebx, eax
test eax, eax
js 0x14005d1e5
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
lea r8, [r13 + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea rcx, [rsp + 0x40]
call fcn.140069e28
mov ebx, eax
xor r9d, r9d
mov esi, dword [rsp + 0x30]
inc r14d
test ebx, ebx
jns 0x14005d148
test ebx, ebx
js 0x14005d0ec
mov dword [r15], esi
jmp 0x14005d116