joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rsi, qword [0x14013ea60]
mov rbp, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x14003c440
lea rcx, [rsp + 0x20]
call fcn.14003c260
mov rsi, qword [rax]
test rsi, rsi
jne 0x14003c486
lea eax, [rsi + 2]
jmp 0x14003c5fe
test rsi, rsi
je 0x14003c46b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x14003c46b
movups xmm0, xmmword [rsi + 0x10]
jmp 0x14003c47c
test rbp, rbp
jne 0x14003c478
lea eax, [rbp + 2]
jmp 0x14003c5fe
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
xor ebx, ebx
test rdi, rdi
je 0x14003c5fc
test rsi, rsi
je 0x14003c5e7
cmp qword [rdi + 8], rbx
je 0x14003c5e7
test rbp, rbp
je 0x14003c5e7
lea rax, [rdi + 0x10]
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
xchg qword [rax], rcx
mov qword [rsp + 0x80], r14
lea r14, [rbx - 1]
test rcx, rcx
je 0x14003c50c
lea rax, [rsp + 0x50]
xchg qword [rcx + 8], rax
xor eax, eax
lock cmpxchg qword [rcx + 0x18], r14
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14003c502
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rsp + 0x60]
call fcn.14003af00
lea rax, [rsi + 0x30]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
xchg qword [rax], rcx
test rcx, rcx
je 0x14003c55f
lea rax, [rsp + 0x30]
xchg qword [rcx + 8], rax
xor eax, eax
lock cmpxchg qword [rcx + 0x18], r14
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14003c555
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rsp + 0x40]
call fcn.14003af00
mov rax, qword [rsi + 0x58]
mov r14, qword [rsp + 0x80]
test rax, rax
je 0x14003c57f
cmp qword [rax + 8], rdi
je 0x14003c5cf
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14003c570
mov edx, 0x30
lea ecx, [rdx - 0x2f]
call fcn.140022b68
test rax, rax
jne 0x14003c596
lea ebx, [rax + 0xc]
jmp 0x14003c5cf
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x28], rbx
mov rcx, qword [rdi + 0x18]
mov qword [rax + 0x18], rcx
test rcx, rcx
je 0x14003c5b2
mov qword [rcx + 0x28], rax
mov qword [rdi + 0x18], rax
mov qword [rax + 0x20], rbx
mov rcx, qword [rsi + 0x58]
mov qword [rax + 0x10], rcx
test rcx, rcx
je 0x14003c5cb
mov qword [rcx + 0x20], rax
mov qword [rsi + 0x58], rax
lea rcx, [rsp + 0x30]
call fcn.14003af60
lea rcx, [rsp + 0x50]
call fcn.14003af60
test ebx, ebx
jne 0x14003c5fc
mov ecx, dword [rdi]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
mov ecx, reloc.WS2_32.dll_inet_addr
cmove ebx, ecx
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003c620
Capabilities:
Allocate thread local storage
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x430
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x420], rax
xor esi, esi
cmp dword [0x14013ea58], esi
je 0x14003c651
lea ebx, [rsi + 1]
jmp 0x14003c77c
mov edx, 0x20
mov qword [rsp + 0x440], rdi
mov qword [0x1401328d8], 1
mov edi, esi
mov qword [0x1401328e0], 1
mov qword [0x14013ea60], rsi
lea ecx, [rdx - 0x1f]
mov qword [0x14013ea68], rsi
mov qword [0x14013ea70], rsi
mov qword [0x14013ea78], rsi
mov dword [0x14013ea5c], esi
mov dword [0x14013ea88], esi
mov qword [0x14013ea80], rsi
mov qword [0x14013ea50], rsi
mov qword [0x14013ea90], rsi
mov qword [0x14013ea98], rsi
mov qword [0x14013eaa8], rsi
mov qword [0x14013eab0], rsi
mov qword [0x14013eab8], rsi
mov qword [0x14013eaa0], rsi
mov dword [0x14013ea58], 1
call fcn.140022b68
mov rbx, rax
test rax, rax
jne 0x14003c6f9
mov qword [0x14013ea60], rax
jmp 0x14003c769
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
cmp eax, 0xffffffff
jne 0x14003c716
mov rcx, rbx
mov edi, reloc.WS2_32.dll_inet_addr
call fcn.1400108e4
mov rbx, rsi
mov qword [0x14013ea60], rbx
test edi, edi
jne 0x14003c769
mov edx, 0x20
mov edi, esi
lea ecx, [rdx - 0x1f]
call fcn.140022b68
mov rbx, rax
test rax, rax
jne 0x14003c741
mov qword [0x14013ea68], rax
jmp 0x14003c769
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
cmp eax, 0xffffffff
jne 0x14003c75e
mov rcx, rbx
mov edi, reloc.WS2_32.dll_inet_addr
call fcn.1400108e4
mov rbx, rsi
mov qword [0x14013ea68], rbx
test edi, edi
je 0x14003c76e
call fcn.14003b430
mov ebx, dword [0x14013ea58]
mov rdi, qword [rsp + 0x440]
mov edx, 0x400
mov dword [0x14013ea88], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14003c7ce
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, str.QUSEREX.DLL
mov edx, 0x400
lea rcx, [rsp + 0x20]
call fcn.140040868
test eax, eax
jne 0x14003c7ce
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14013eac0], rax
jmp 0x14003c7d5
mov rax, qword [0x14013eac0]
test rax, rax
je 0x14003c7fd
lea rdx, str.QueueUserAPCEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [0x14013ea50], rax
mov rax, qword [0x14013eac0]
jmp 0x14003c804
mov rcx, qword [0x14013ea50]
test rcx, rcx
jne 0x14003c821
lea rcx, [0x14003a600]
mov qword [0x14013ea50], rcx
test rax, rax
je 0x14003c86b
mov rcx, rax
jmp 0x14003c865
lea rdx, str.QueueUserAPCEx_Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c850
call rax
test eax, eax
je 0x14003c850
cmp qword [0x14013eac0], rsi
mov eax, ebx
je 0x14003c874
or dword [0x14013ea88], 2
jmp 0x14003c874
lea rcx, [0x14003a600]
mov qword [0x14013ea50], rcx
mov rcx, qword [0x14013eac0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov qword [0x14013eac0], rsi
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + 0x448]
add rsp, 0x430
pop rsi
ret
Function at 0x140042d30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov r9, rdx
xor edx, edx
lea r8d, [rdx + 0x50]
mov rbx, rcx
call fcn.14002a5a0
mov esi, 1
mov ecx, esi
call qword [0x14013eb60]
lea rcx, [0x140106c6c]
lea r9, [0x1400fca4c]
mov dword [rbx + 0x38], eax
cdq
movzx edx, dl
add eax, edx
mov r8d, eax
movzx eax, al
sub eax, edx
sar r8d, 8
lea rdx, [0x14011a6d0]
cmp eax, 0xa
mov dword [rsp + 0x20], eax
cmovb r9, rcx
lea rcx, [rbx + 0x3c]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, str.CMN_DONGLE_DIAGNOSTICS
call fcn.140020944
mov ecx, dword [0x14013eb00]
test rax, rax
cmovne ecx, esi
cmp dword [rbx + 0x38], 0x600
mov dword [0x14013eb00], ecx
jge 0x140042dfd
test ecx, ecx
je 0x140042deb
test rdi, rdi
je 0x140042deb
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x140042deb
mov rcx, qword [rdi]
lea r9d, [rsi + 0x5c]
lea r8, str.Invalid_WIBU_driver_version_n
lea edx, [rsi + 5]
call rax
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r8, [rsp + 0x40]
mov r9d, 4
mov edx, 0x100
mov ecx, esi
call qword [0x14013eb90]
xor eax, eax
test byte [rsp + 0x40], 2
je 0x140042e23
mov dword [rbx + 0x48], esi
jmp 0x140042e26
mov dword [rbx + 0x48], eax
cmp dword [rbx + 0x48], eax
mov rsi, qword [rsp + 0x50]
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x4c], eax
mov rbx, qword [rsp + 0x48]
setne al
add rsp, 0x30
pop rdi
ret
Function at 0x1400441b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor ebx, ebx
movsxd r15, r8d
mov edi, edx
mov r14, rcx
test rcx, rcx
je 0x14004432e
test edx, edx
je 0x14004432e
mov qword [rsp + 0x100], rsi
lea esi, [r15 + rdi]
mov dword [rbp - 0x79], 0xa8e3520c
mov dword [rbp - 0x75], 0x68c7d4f6
mov dword [rbp - 0x71], 0x881c36f2
mov dword [rbp - 0x6d], 0xde973615
mov dword [rbp - 0x69], 0xdf9e9a55
mov dword [rbp - 0x65], 0x52f3d505
mov dword [rbp - 0x61], 0xfbcbe1e1
mov dword [rbp - 0x5d], 0xca7474b4
mov dword [rbp - 0x59], 0x6272ed29
mov dword [rbp - 0x55], 0xa133ba6a
mov dword [rbp - 0x51], 0x60272bb0
mov dword [rbp - 0x4d], 0xa4d18187
mov dword [rbp - 0x49], 0x6bd2f710
mov dword [rbp - 0x45], 0xc512b5ce
cmp esi, 0x38
ja 0x140044276
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 9]
mov r8d, edi
add rdx, r15
xor r9d, r9d
call fcn.14002a480
cmp esi, 0x38
mov rsi, qword [rsp + 0x100]
mov dword [rbp - 0x79], 0xa04bb06c
mov dword [rbp - 0x75], 0x4e73efad
mov dword [rbp - 0x71], 0xd2902fa3
mov dword [rbp - 0x6d], 0x75a245b0
mov dword [rbp - 0x69], 0xfba3e885
mov dword [rbp - 0x65], 0x3881d47b
mov dword [rbp - 0x61], 0xa4dcf5d6
mov dword [rbp - 0x5d], 0xb9f84cba
mov dword [rbp - 0x59], 0x7f8a83e9
mov dword [rbp - 0x55], 0x17ac18a6
mov dword [rbp - 0x51], 0xaa1188b9
mov dword [rbp - 0x4d], 0x76f3477a
mov dword [rbp - 0x49], 0xa027437
mov dword [rbp - 0x45], 0x699c3a1d
ja 0x1400442fb
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x41]
mov r8, rdi
add rdx, r15
xor r9d, r9d
call fcn.14002a480
mov eax, 1
test edi, edi
je 0x140044330
xor edx, edx
mov r8, rdi
nop dword [rax]
movzx ecx, byte [rbp + rdx - 0x41]
lea rdx, [rdx + 1]
xor cl, byte [rbp + rdx - 0xa]
cmp cl, byte [rdx + r14 - 1]
cmovne ebx, eax
dec r8
jne 0x140044310
test ebx, ebx
je 0x140044330
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret
Function at 0x14004bb10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
cmp dword [rcx + 8], 2
mov rbp, rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
jne 0x14004bb5c
mov rdi, qword [rcx + 0x10]
jmp 0x14004bbf2
mov rcx, qword [rcx + 0x10]
mov r14d, 1
call fcn.14001684c
lea rdx, [rsp + 0x50]
mov ecx, eax
call fcn.14003e8ac
test eax, eax
jne 0x14004bc93
mov ebx, dword [rsp + 0x64]
lea eax, [rbx + 1]
movsxd r15, eax
mov rcx, r15
call fcn.140010258
mov rdi, rax
mov rsi, rax
test rax, rax
je 0x14004bc93
xor r9d, r9d
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.14002a5a0
mov rcx, qword [rbp + 0x10]
call fcn.14001684c
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call fcn.14000f7dc
test eax, eax
jle 0x14004bbf2
nop word [rax + rax]
movsxd rcx, eax
sub ebx, eax
add rsi, rcx
mov rcx, qword [rbp + 0x10]
call fcn.14001684c
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call fcn.14000f7dc
test eax, eax
jg 0x14004bbd0
test rdi, rdi
je 0x14004bc3b
mov rcx, qword [0x14013ec38]
lea r8, [rsp + 0x40]
lea r9, [0x14012e1f0]
movsxd rdx, dword [rcx + 0x130]
mov rax, qword [rcx + 0x128]
mov qword [rsp + 0x30], r8
mov rax, qword [rax + rdx*8]
lea r8, [rsp + 0x48]
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayLock
call fcn.140077210
test r14d, r14d
je 0x14004bc4f
mov rcx, qword [0x14013ec38]
mov rdx, rdi
call fcn.140064880
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x14004bc7d
mov rcx, qword [0x14013ec30]
lea rdx, str.ERRORS:__s_n
call fcn.140008700
mov rdx, qword [rsp + 0x40]
mov rcx, qword [0x14013ec38]
call fcn.140064880
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14004bc93
mov rcx, qword [0x14013ec38]
call fcn.140064880
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000c9f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140055280
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0xc0], rax
cmp dword [0x14013a780], 0
jne 0x14005539a
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor edx, edx
mov r8d, __WSAFDIsSet
call fcn.14002a5a0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140055372
mov eax, dword [rsp + 0x30]
cmp eax, 1
jne 0x14005530c
mov eax, 2
mov dword [0x14013a780], 1
mov dword [0x14013a77c], eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0xd8
ret
cmp eax, 2
je 0x140055349
cmp dword [rsp + 0x24], 6
jae 0x140055349
test eax, eax
jne 0x140055372
mov eax, 3
mov dword [0x14013a780], 1
mov dword [0x14013a77c], eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0xd8
ret
mov eax, 1
mov dword [0x14013a77c], eax
mov dword [0x14013a780], eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0xd8
ret
mov eax, dword [0x14013a77c]
mov dword [0x14013a780], 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0xd8
ret
mov eax, dword [0x14013a77c]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0xd8
ret
Function at 0x1400553c0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call fcn.140055280
mov edx, ebx
mov rcx, rdi
cmp eax, 2
jne 0x1400553ed
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140055940
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140055a10
push rbx
push rbp
push rdi
sub rsp, 0x20
xor ebx, ebx
movsxd rdi, edx
mov rbp, rcx
mov dword [rsp + 0x48], ebx
test edx, edx
je 0x140055961
test rcx, rcx
je 0x140055a04
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
movsxd rax, dword [rsp + 0x48]
test eax, eax
je 0x140055a04
mov rcx, rax
mov qword [rsp + 0x40], rsi
call fcn.140010258
mov rsi, rax
test rax, rax
je 0x1400559ff
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400559f7
lea rdx, [rsp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x50], r14
call fcn.140054ba0
mov r14, rax
test rax, rax
je 0x1400559f2
test edi, edi
je 0x1400559ee
cmp dword [rsp + 0x48], edi
jle 0x1400559cb
lea ecx, [rdi - 1]
mov dword [rsp + 0x48], ecx
mov r8, rdi
xor r9d, r9d
xor edx, edx
mov rcx, rbp
call fcn.14002a5a0
movsxd r8, dword [rsp + 0x48]
xor r9d, r9d
mov rdx, r14
mov rcx, rbp
call fcn.14002a480
mov ebx, dword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rcx, rsi
call fcn.140064760
mov rsi, qword [rsp + 0x40]
mov eax, ebx
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
movsxd rdi, edx
mov r14, rcx
mov dword [rsp + 0x48], ebx
mov esi, ebx
test edx, edx
je 0x140055a38
test rcx, rcx
je 0x140055ae1
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
movsxd rax, dword [rsp + 0x48]
test eax, eax
je 0x140055ae1
mov rcx, rax
mov qword [rsp + 0x40], rbp
add rcx, rcx
call fcn.140010258
mov rbp, rax
test rax, rax
je 0x140055adc
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140055ac7
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.140054ff0
mov rsi, rax
test rax, rax
je 0x140055ac7
test edi, edi
je 0x140055ac3
cmp dword [rsp + 0x48], edi
jle 0x140055aa0
lea ecx, [rdi - 1]
mov dword [rsp + 0x48], ecx
mov r8, rdi
xor r9d, r9d
xor edx, edx
mov rcx, r14
call fcn.14002a5a0
movsxd r8, dword [rsp + 0x48]
xor r9d, r9d
mov rdx, rsi
mov rcx, r14
call fcn.14002a480
mov ebx, dword [rsp + 0x48]
mov rcx, rbp
call fcn.140064760
test rsi, rsi
je 0x140055adc
mov rcx, rsi
call fcn.140064760
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140055940
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call fcn.140055280
mov edx, ebx
mov rcx, rdi
cmp eax, 2
jne 0x1400553ed
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140055940
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140055a10
push rbx
push rbp
push rdi
sub rsp, 0x20
xor ebx, ebx
movsxd rdi, edx
mov rbp, rcx
mov dword [rsp + 0x48], ebx
test edx, edx
je 0x140055961
test rcx, rcx
je 0x140055a04
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
movsxd rax, dword [rsp + 0x48]
test eax, eax
je 0x140055a04
mov rcx, rax
mov qword [rsp + 0x40], rsi
call fcn.140010258
mov rsi, rax
test rax, rax
je 0x1400559ff
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400559f7
lea rdx, [rsp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x50], r14
call fcn.140054ba0
mov r14, rax
test rax, rax
je 0x1400559f2
test edi, edi
je 0x1400559ee
cmp dword [rsp + 0x48], edi
jle 0x1400559cb
lea ecx, [rdi - 1]
mov dword [rsp + 0x48], ecx
mov r8, rdi
xor r9d, r9d
xor edx, edx
mov rcx, rbp
call fcn.14002a5a0
movsxd r8, dword [rsp + 0x48]
xor r9d, r9d
mov rdx, r14
mov rcx, rbp
call fcn.14002a480
mov ebx, dword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rcx, rsi
call fcn.140064760
mov rsi, qword [rsp + 0x40]
mov eax, ebx
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
movsxd rdi, edx
mov r14, rcx
mov dword [rsp + 0x48], ebx
mov esi, ebx
test edx, edx
je 0x140055a38
test rcx, rcx
je 0x140055ae1
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
movsxd rax, dword [rsp + 0x48]
test eax, eax
je 0x140055ae1
mov rcx, rax
mov qword [rsp + 0x40], rbp
add rcx, rcx
call fcn.140010258
mov rbp, rax
test rax, rax
je 0x140055adc
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140055ac7
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.140054ff0
mov rsi, rax
test rax, rax
je 0x140055ac7
test edi, edi
je 0x140055ac3
cmp dword [rsp + 0x48], edi
jle 0x140055aa0
lea ecx, [rdi - 1]
mov dword [rsp + 0x48], ecx
mov r8, rdi
xor r9d, r9d
xor edx, edx
mov rcx, r14
call fcn.14002a5a0
movsxd r8, dword [rsp + 0x48]
xor r9d, r9d
mov rdx, rsi
mov rcx, r14
call fcn.14002a480
mov ebx, dword [rsp + 0x48]
mov rcx, rbp
call fcn.140064760
test rsi, rsi
je 0x140055adc
mov rcx, rsi
call fcn.140064760
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140055a10
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call fcn.140055280
mov edx, ebx
mov rcx, rdi
cmp eax, 2
jne 0x1400553ed
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140055940
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140055a10
push rbx
push rbp
push rdi
sub rsp, 0x20
xor ebx, ebx
movsxd rdi, edx
mov rbp, rcx
mov dword [rsp + 0x48], ebx
test edx, edx
je 0x140055961
test rcx, rcx
je 0x140055a04
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
movsxd rax, dword [rsp + 0x48]
test eax, eax
je 0x140055a04
mov rcx, rax
mov qword [rsp + 0x40], rsi
call fcn.140010258
mov rsi, rax
test rax, rax
je 0x1400559ff
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400559f7
lea rdx, [rsp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x50], r14
call fcn.140054ba0
mov r14, rax
test rax, rax
je 0x1400559f2
test edi, edi
je 0x1400559ee
cmp dword [rsp + 0x48], edi
jle 0x1400559cb
lea ecx, [rdi - 1]
mov dword [rsp + 0x48], ecx
mov r8, rdi
xor r9d, r9d
xor edx, edx
mov rcx, rbp
call fcn.14002a5a0
movsxd r8, dword [rsp + 0x48]
xor r9d, r9d
mov rdx, r14
mov rcx, rbp
call fcn.14002a480
mov ebx, dword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rcx, rsi
call fcn.140064760
mov rsi, qword [rsp + 0x40]
mov eax, ebx
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
movsxd rdi, edx
mov r14, rcx
mov dword [rsp + 0x48], ebx
mov esi, ebx
test edx, edx
je 0x140055a38
test rcx, rcx
je 0x140055ae1
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
movsxd rax, dword [rsp + 0x48]
test eax, eax
je 0x140055ae1
mov rcx, rax
mov qword [rsp + 0x40], rbp
add rcx, rcx
call fcn.140010258
mov rbp, rax
test rax, rax
je 0x140055adc
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140055ac7
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.140054ff0
mov rsi, rax
test rax, rax
je 0x140055ac7
test edi, edi
je 0x140055ac3
cmp dword [rsp + 0x48], edi
jle 0x140055aa0
lea ecx, [rdi - 1]
mov dword [rsp + 0x48], ecx
mov r8, rdi
xor r9d, r9d
xor edx, edx
mov rcx, r14
call fcn.14002a5a0
movsxd r8, dword [rsp + 0x48]
xor r9d, r9d
mov rdx, rsi
mov rcx, r14
call fcn.14002a480
mov ebx, dword [rsp + 0x48]
mov rcx, rbp
call fcn.140064760
test rsi, rsi
je 0x140055adc
mov rcx, rsi
call fcn.140064760
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140055b00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov r14, r9
mov rsi, r8
mov rax, rdx
mov r15, rcx
mov edi, r12d
mov ebx, r12d
mov dword [rsp + 0x60], r12d
test rcx, rcx
je 0x140055c32
test rdx, rdx
je 0x140055c32
test r8, r8
je 0x140055c32
test r9, r9
je 0x140055c32
mov dword [r9], r12d
lea rdx, [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x68], rbp
mov dword [r8], r12d
call fcn.140054d40
mov rbp, rax
test rax, rax
je 0x140055c18
cmp dword [rsp + 0x60], ebx
je 0x140055c03
lea rax, [rsp + 0x60]
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140055c03
mov eax, dword [rsp + 0x60]
inc eax
movsxd rcx, eax
call fcn.140010258
mov rdi, rax
test rax, rax
je 0x140055c03
lea rax, [rsp + 0x60]
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140055c03
mov eax, dword [rsi]
dec eax
cmp eax, 1
jbe 0x140055bf5
mov eax, dword [rsp + 0x60]
mov rbx, rdi
mov edi, r12d
mov dword [r14], eax
jmp 0x140055c03
mov rdx, r14
mov rcx, rdi
call fcn.140054ba0
mov rbx, rax
mov rcx, rbp
call fcn.140064760
test rdi, rdi
je 0x140055c18
mov rcx, rdi
call fcn.140064760
mov rax, rbx
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret