joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a7dd0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1800a7e04
lea ecx, [rbx + 0x57]
mov dword [0x18017346c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800a7e2a
test al, 0x10
jne 0x1800a7e6a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1800a7e6a
mov rcx, rbx
call fcn.1800a7a00
test eax, eax
jne 0x1800a7e6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18017346c], eax
test eax, eax
je 0x1800a7e5d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1800a7e79
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800a7e90
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1800a7ec4
lea ecx, [rbx + 0x57]
mov dword [0x18017346c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800a7eea
test al, 0x10
jne 0x1800a7f2a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800a7f2a
mov rcx, rbx
call fcn.1800a7bd0
test eax, eax
jne 0x1800a7f2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18017346c], eax
test eax, eax
je 0x1800a7f1d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1800a7f39
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800aa2e0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800aa309
lea ecx, [rbx + 0x57]
mov dword [0x18017346c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800aa160]
lea edx, [r9 + 0x20]
call fcn.1800a8450
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test eax, eax
jne 0x1800aa35a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18017346c], eax
test eax, eax
je 0x1800aa35a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800aa370
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800aa399
lea ecx, [rbx + 0x57]
mov dword [0x18017346c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800aa220]
lea edx, [r9 + 0x20]
call fcn.1800a85c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x1800aa3ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18017346c], eax
test eax, eax
je 0x1800aa3ea
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800abb00
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1800a4f64
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800a4c30
jmp 0x1800a4f6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x18017346c], eax
test eax, eax
je 0x1800a4f7e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x1800a4f00
Function at 0x1800abe50
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.1800a3690
test eax, eax
je 0x1800a542d
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800a52a0
jmp 0x1800a54a4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006a0a0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1800a5483
lea rdx, [0x18010ba80]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.1800f17a0
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800a4c30
jmp 0x1800a5489
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x18017346c], eax
test eax, eax
je 0x1800a549d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x1800a53f0

Function at 0x1800ac0d0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x1800ac1e6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800ac156
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.1800a49f0
test eax, eax
je 0x1800ac1d2
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18006a0a0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800ab650
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800ac1d2
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18006c190
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.1800a4c30
jmp 0x1800ac1ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x18017346c], eax
test eax, eax
je 0x1800ac202
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800ac0d0
Function at 0x1800acfc0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
lea rcx, [0x180120b00]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800ad0cc
lea rcx, [rsp + 0x20]
call fcn.1800a49f0
test eax, eax
je 0x1800ad0b3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800ab650
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800ad0ab
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18006c190
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800a4c30
mov eax, 1
jmp 0x1800ad0ce
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800acfc0

Function at 0x1800ad230
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
lea rcx, [0x180120b30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800ad33c
lea rcx, [rsp + 0x20]
call fcn.1800a49f0
test eax, eax
je 0x1800ad323
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800ab650
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800ad31b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18006c190
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800a4c30
mov eax, 1
jmp 0x1800ad33e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800ad230
Function at 0x1800aee40
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x1800ac1e6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800ac156
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.1800a49f0
test eax, eax
je 0x1800ac1d2
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18006a0a0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800ab650
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800ac1d2
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18006c190
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.1800a4c30
jmp 0x1800ac1ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x18017346c], eax
test eax, eax
je 0x1800ac202
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800ac0d0

Function at 0x1800af2c0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
lea rcx, [0x180120b00]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800ad0cc
lea rcx, [rsp + 0x20]
call fcn.1800a49f0
test eax, eax
je 0x1800ad0b3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800ab650
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800ad0ab
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18006c190
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800a4c30
mov eax, 1
jmp 0x1800ad0ce
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800acfc0
Function at 0x1800af380
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
lea rcx, [0x180120b30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800ad33c
lea rcx, [rsp + 0x20]
call fcn.1800a49f0
test eax, eax
je 0x1800ad323
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800ab650
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800ad31b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18006c190
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800a4c30
mov eax, 1
jmp 0x1800ad33e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800ad230
Function at 0x1800b0c60
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x390
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rdi, rdx
mov r8, rdx
mov edx, 4
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test eax, eax
je 0x1800b0c3c
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x3c0], rsi
mov byte [rsp + 0x270], 0
call fcn.18006a0a0
lea rdx, str._s
lea rcx, [rsp + 0x270]
mov r8, rbp
call fcn.18006f6e4
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x20], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800b0c32
lea rdx, [0x180121278]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1800b0c0f
lea rdx, str.._C
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1800b0c0f
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.18006a0a0
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rsp + 0x160]
mov r8, rbp
call fcn.18006f6e4
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x160]
je 0x1800b0bff
mov rdx, rdi
call 0x1800b0ad0
jmp 0x1800b0c0d
mov r8, rdi
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test ebx, ebx
je 0x1800b0c29
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800b0b81
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x3c0]
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x390
pop rdi
pop rbp
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1800b2740
mov rcx, rbx
mov rdx, rax
add rsp, 0x20
pop rbx
jmp 0x1800b0ad0
Function at 0x1800b1b10
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x40
xor ebx, ebx
lea rax, [rsp + 0x78]
mov rsi, rdx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rdx], rbx
mov rbp, rcx
mov rdx, rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1800b1b70
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1800b1b70
xor eax, eax
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x60], rdi
call fcn.18006b890
mov ecx, dword [rsp + 0x68]
mov qword [rsi], rax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18006b890
mov r8, qword [rsi]
mov rdi, rax
test r8, r8
je 0x1800b1bdb
test rax, rax
je 0x1800b1bec
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x70]
mov rdx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test rdi, rdi
je 0x1800b1be8
mov rcx, rdi
call fcn.18006aac0
test ebx, ebx
jne 0x1800b1bf9
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800b1bf9
call fcn.18006aac0
mov eax, ebx
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800b47d0
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2f0
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, qword [rsp + 0x350]
mov rbp, rcx
mov r12, r8
mov r13, rdx
xor r14d, r14d
lea rcx, [rsp + 0xe1]
mov ebx, r14d
mov r8d, 0x1f3
xor edx, edx
mov byte [rsp + 0xe0], bl
mov rsi, r9
call fcn.18006a0a0
test r12, r12
je 0x1800b4855
lea r8, [rsp + 0xe0]
mov r9d, 0x1f3
or edx, 0xffffffff
mov rcx, r12
mov dword [rsp + 0x20], r14d
call fcn.18005cb10
lea rbx, [rsp + 0xe0]
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], 0x68
lea r8d, [rdx + 0x60]
call fcn.18006a0a0
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x50], r14
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
test eax, eax
je 0x1800b48f6
test rsi, rsi
je 0x1800b48c9
mov ecx, dword [rsp + 0x60]
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x50]
test rdi, rdi
je 0x1800b48e3
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800b48ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800b48ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 8], eax
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x2f0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800b5900
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x808]
sub rsp, 0x908
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
mov rsi, qword [rbp + 0x870]
mov rdi, qword [rbp + 0x878]
xor eax, eax
mov rbx, r8
mov r15, rcx
mov qword [rsp + 0x68], rdx
lea r8d, [rax + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
mov r12, r9
mov r14d, eax
mov r13d, eax
mov dword [rsp + 0x70], 0x68
call fcn.18006a0a0
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x50], rcx
mov word [rbp + 0x1f0], cx
lea rcx, [rbp + 0x1f2]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.18006a0a0
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1800b59c5
lea r8, [rbp + 0x1f0]
mov r9d, 0x104
or edx, 0xffffffff
mov rcx, rax
mov dword [rsp + 0x20], r13d
call fcn.18005c860
lea r14, [rbp + 0x1f0]
xor eax, eax
lea rcx, [rbp + 0x402]
xor edx, edx
mov r8d, 0x3e6
mov word [rbp + 0x400], ax
call fcn.18006a0a0
test rbx, rbx
je 0x1800b5a0c
xor eax, eax
lea r8, [rbp + 0x400]
mov r9d, 0x1f4
or edx, 0xffffffff
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.18005caf0
lea r13, [rbp + 0x400]
lea rcx, [rbp - 0x1e]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x20], bx
call fcn.18006a0a0
test r12, r12
je 0x1800b5a49
lea r8, [rbp - 0x20]
mov r9d, 0x104
or edx, 0xffffffff
mov rcx, r12
mov dword [rsp + 0x20], ebx
call fcn.18005caf0
lea r11, [rbp - 0x20]
mov qword [rbp - 0x80], r11
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov rcx, r14
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x1800b5abf
test rsi, rsi
je 0x1800b5a92
mov ecx, dword [rsp + 0x60]
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x50]
test rdi, rdi
je 0x1800b5aac
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800b5ac9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800b5ac9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15 + 8], eax
mov eax, ebx
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x908
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800b6c10
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x1f90
call fcn.1800f4a50
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x1f80], rax
mov esi, r9d
mov r14, r8
mov r13, rdx
mov rdi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, r13
call fcn.18005fb40
or r8d, 0xffffffff
xor edx, edx
mov rcx, r14
call fcn.18005b220
call fcn.1800bdcb0
mov rbx, qword [0x180173fb8]
test rbx, rbx
je 0x1800b6d7f
cmp esi, 0xffffffff
jne 0x1800b6c9f
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov rcx, rdi
call qword [rbx + 0x70]
mov esi, eax
mov rbx, qword [0x180173fb8]
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x40], ebp
xor edx, edx
mov r8d, 0x1f3c
lea rcx, [rsp + 0x44]
call fcn.18006a0a0
lea r8, [rsp + 0x20]
mov edx, 0x1f40
lea rcx, [rsp + 0x40]
call rbx
test eax, eax
je 0x1800b6d76
mov eax, dword [rsp + 0x20]
shr eax, 2
test eax, eax
je 0x1800b6d6f
lea rbx, [rsp + 0x40]
mov r12d, eax
nop dword [rax + rax]
cmp esi, 0xfffffffe
je 0x1800b6d04
mov rax, qword [rdi]
mov edx, dword [rbx]
mov rcx, rdi
call qword [rax + 0x70]
cmp esi, eax
jne 0x1800b6d66
test ebp, ebp
jne 0x1800b6d25
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea r8d, [rbp + 1]
lea rdx, str.SeDebugPrivilege
call fcn.1800b1aa0
mov ebp, 1
mov r8d, dword [rbx]
mov edx, dword [r13 + 8]
mov rcx, r13
call fcn.18005fda0
mov r11, qword [rdi]
mov r8d, dword [rbx]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [r11 + 0x80]
nop
lea r8, [rsp + 0x28]
mov edx, dword [r14 + 8]
mov rcx, r14
call fcn.18005b470
nop
lea rcx, [rsp + 0x28]
call fcn.1800561b0
add rbx, 4
dec r12
jne 0x1800b6cf0
mov eax, 1
jmp 0x1800b6d81
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 8], eax
xor eax, eax
mov rcx, qword [rsp + 0x1f80]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x1f90
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret