joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f8a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp ecx, 2
jne 0x14007f9a3
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov r14, rdx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov ecx, 0x2002
movsxd rsi, r8d
movzx ebp, r9b
lea rdx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14007f98e
mov rcx, rax
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
je 0x14007f989
mov r8, rsi
mov rdx, r14
mov rcx, rax
call fcn.14008dc80
mov rcx, rbx
mov byte [rsi + rdi], 0
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bpl, bpl
jne 0x14007f936
mov rcx, qword [0x14011e228]
xor r9d, r9d
mov edx, 0x8002
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x14011e228]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14007f963
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14007f96c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test bpl, bpl
jne 0x14007f989
mov rcx, qword [0x14011e228]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140080e50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
xor r8d, r8d
mov rbx, rcx
mov edx, 0x1048
mov ebp, r9d
lea ecx, [r8 + 1]
call fcn.140012100
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r14, rax
mov dword [rax], 0
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r14 + 0x10], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r14 + 0x18], rax
mov rax, qword [0x140121078]
mov qword [r14 + 0x1040], rdi
mov word [r14 + 0x21], 0
mov byte [r14 + 0x20], 0
mov qword [r14 + 0x28], rsi
mov dword [r14 + 0x30], ebp
test rax, rax
jne 0x140080ef4
lea rcx, [0x140080b70]
call fcn.14006be50
mov qword [0x140121078], rax
mov rdx, r14
mov rcx, rax
call fcn.14006aef0
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [r14 + 8]
lea r8, [0x140080f60]
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140080f34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov byte [r14 + 0x23], 1
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140081130
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
xor r8d, r8d
mov rbx, rcx
mov edx, 0x1048
mov ebp, r9d
lea ecx, [r8 + 1]
call fcn.140012100
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r14, rax
mov dword [rax], 1
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r14 + 0x10], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [r14 + 0x50]
mov dword [r14 + 0x20], 0
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rdi
call fcn.14006c420
mov rax, qword [0x140121078]
xor ebx, ebx
mov dword [r14 + 0x78], ebx
mov qword [r14 + 0x80], rsi
mov dword [r14 + 0x30], ebp
test rax, rax
jne 0x1400811df
lea rcx, [0x140080b70]
call fcn.14006be50
mov qword [0x140121078], rax
mov rdx, r14
mov rcx, rax
call fcn.14006aef0
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [r14 + 8]
lea r8, [0x140081240]
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14008121b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140081580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
cmp byte [0x14012108b], 0
jne 0x1400815e5
mov byte [0x14012108b], 1
call fcn.140081600
test eax, eax
je 0x1400815e5
mov rdx, qword [0x140121098]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x14012108c], eax
test eax, eax
je 0x1400815e5
mov rdx, qword [0x140121098]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400815e5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov qword [0x1401210a0], rax
setne al
add rsp, 0x28
ret
mov rax, qword [0x1401210a0]
test rax, rax
setne al
add rsp, 0x28
ret

Function at 0x1400817a0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rdi
sub rsp, 0x178
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 0x10], rsi
xor bpl, bpl
mov qword [r11 - 0x18], r15
xor r15d, r15d
mov esi, r15d
cmp byte [0x1401210a8], sil
lea rdi, [r15 - 1]
jne 0x14008194c
lea rdx, [rsp + 0x50]
mov byte [0x1401210a8], 1
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x14008194c
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x1a0], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov r8d, eax
lea rcx, str._sputty__lu__llu.chm
mov r14d, eax
mov ebx, r15d
call fcn.14006c6b0
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400818cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14008193c
mov rcx, rsi
call fcn.140011ff0
inc rbx
lea rdx, [rsp + 0x50]
mov r9, rbx
lea rcx, str._sputty__lu__llu.chm
mov r8d, r14d
call fcn.14006c6b0
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x20], 1
mov rsi, rax
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140081868
mov eax, dword [0x14012108c]
mov ebx, r15d
mov r14, qword [0x1401210a0]
test eax, eax
je 0x140081928
nop dword [rax]
nop word [rax + rax]
sub eax, ebx
mov edx, ebx
add rdx, r14
mov dword [rsp + 0x40], r15d
mov r8d, eax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140081991
mov eax, dword [rsp + 0x40]
inc eax
add ebx, eax
mov eax, dword [0x14012108c]
cmp ebx, eax
jb 0x1400818f0
mov qword [0x140121080], rsi
mov bpl, 1
mov rsi, r15
mov byte [0x140121088], 1
mov rbx, qword [rsp + 0x190]
mov r14, qword [rsp + 0x1a0]
mov rcx, rsi
call fcn.140011ff0
mov r15, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x198]
cmp rdi, 0xffffffffffffffff
je 0x140081973
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bpl
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0x178
pop rdi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x14008193c
Function at 0x1400819a0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
cmp byte [0x140121089], 0
je 0x1400819be
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x12]
call qword [0x140121090]
mov rcx, qword [0x140121080]
test rcx, rcx
je 0x1400819de
cmp byte [0x140121088], 0
je 0x1400819de
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rsp, 0x28
ret

Function at 0x1400819f0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x140121080]
test rcx, rcx
je 0x140081a2e
cmp byte [0x140121088], 0
je 0x140081a2e
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x12]
call qword [0x140121090]
mov rcx, qword [0x140121080]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x140121080]
call fcn.140011ff0
mov qword [0x140121080], 0
mov byte [0x140121088], 0
add rsp, 0x28
ret

Function at 0x140082be0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
cmp byte [0x1401218d8], bl
jne 0x140082c4c
lea rcx, str.secur32.dll
call fcn.140082e60
lea rcx, str.sspicli.dll
mov rdi, rax
call fcn.140082e60
test rdi, rdi
je 0x140082c39
lea rdx, str.GetUserNameExA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401218d0], rax
mov byte [0x1401218d8], 1
jmp 0x140082c53
mov rax, rbx
mov qword [0x1401218d0], rbx
mov byte [0x1401218d8], 1
jmp 0x140082c53
mov rax, qword [0x1401218d0]
test rax, rax
je 0x140082cb8
xor edx, edx
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 8]
call rax
mov ecx, dword [rsp + 0x30]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.140012100
lea r8, [rsp + 0x30]
mov rdx, rax
mov ecx, 8
mov rdi, rax
call qword [0x1401218d0]
test al, al
mov rcx, rdi
setne sil
test al, al
je 0x140082cae
mov edx, 0x40
call fcn.14008e2f8
test rax, rax
je 0x140082cb3
mov byte [rax], bl
jmp 0x140082cb3
call fcn.140011ff0
test sil, sil
jne 0x140082d0f
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [rsp + 0x30]
mov r8d, 0x100
test eax, eax
cmove ecx, r8d
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r8 + 1]
call fcn.140012100
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
setne sil
test eax, eax
jne 0x140082d0c
mov rcx, rdi
call fcn.140011ff0
test sil, sil
mov rsi, qword [rsp + 0x40]
cmovne rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140082e60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [0x140121900], 0
mov rbx, rcx
jne 0x140082edb
mov edx, dword [0x140121908]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, eax
cmp rax, qword [0x140121908]
jb 0x140082edb
mov rcx, qword [0x140121900]
lea rdx, [0x140121908]
mov byte [rsp + 0x28], 0
mov r9, rax
mov r8d, 1
mov qword [rsp + 0x20], 1
call fcn.140012000
mov edx, dword [0x140121908]
mov rcx, rax
mov qword [0x140121900], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, eax
cmp rax, qword [0x140121908]
jae 0x140082e90
mov rcx, qword [0x140121900]
lea rdx, [0x1400c7b8c]
xor r9d, r9d
mov r8, rbx
call fcn.14006c590
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rdi
mov rbx, rax
call fcn.140011ff0
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140082fb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor dil, dil
mov qword [rsp + 0x30], rcx
xor esi, esi
xor ebx, ebx
mov rbp, r8
test rdx, rdx
je 0x140082feb
lea r8, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140083085
mov rcx, qword [rsp + 0x30]
mov dil, 1
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140083075
cmp dword [rsp + 0x60], 1
jne 0x140083075
mov ecx, dword [rsp + 0x68]
lea edx, [rax + 1]
inc ecx
xor r8d, r8d
call fcn.140012100
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x60]
mov rbx, rax
xor r8d, r8d
mov eax, dword [rsp + 0x68]
mov rdx, rbp
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140083075
cmp dword [rsp + 0x60], 1
jne 0x140083075
mov eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x68]
ja 0x140083075
mov byte [rax + rbx], sil
mov rsi, rbx
xor ebx, ebx
test dil, dil
je 0x140083085
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140011ff0
mov rbx, qword [rsp + 0x70]
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140085bb0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rcx
mov edx, 0x107
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x190]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140085bf0
movzx eax, word [0x1400ccbc4]
lea rdx, [rsp + 0x30]
mov word [rcx], ax
movzx eax, byte [0x1400ccbc6]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140085c57
nop word [rax + rax]
mov edx, 0x140
lea rcx, [rsp + 0x30]
call rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140085c30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 4
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
call rbx
mov edx, 0x20
lea rcx, [rsp + 0x170]
call fcn.140085f00
test al, al
je 0x140085ca4
mov edx, 0x20
lea rcx, [rsp + 0x170]
call rbx
mov edx, 0x20
lea rcx, [rsp + 0x170]
call fcn.140083280
mov rcx, rbx
call fcn.140089120
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14008ce70
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2b0
pop rdi
ret

Function at 0x140085cd0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea ecx, [r8 + 1]
call fcn.140050ec0
call qword [sym.imp.USER32.dll_GetCapture]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea ecx, [r8 + 2]
call fcn.140050ec0
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea ecx, [r8 + 3]
call fcn.140050ec0
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov r8d, 4
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
lea ecx, [r8 + 8]
call fcn.140050ec0
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 8
lea rdx, [rsp + 0x40]
lea ecx, [r8 + 5]
call fcn.140050ec0
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r8d, 0x38
lea rdx, [rsp + 0x48]
lea ecx, [r8 - 0x32]
call fcn.140050ec0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rsp + 0x90]
lea rax, [rsp + 0x98]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov r8d, 0x20
lea rdx, [rsp + 0x80]
lea ecx, [r8 - 0x12]
call fcn.140050ec0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x90]
lea rax, [rsp + 0x98]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov r8d, 0x20
lea rdx, [rsp + 0x80]
lea ecx, [r8 - 0x11]
call fcn.140050ec0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0xb8
ret
Function at 0x140086040
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
xor ebp, ebp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x40000000
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400860d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x140086154
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
je 0x14008611d
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x40000000
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140086084
mov qword [rsp + 0x60], rsi
call fcn.140087530
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x14008618b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140083130
mov rdx, rax
lea rcx, str.Unable_to_get_user_SID:__s
call fcn.14006c6b0
mov qword [r14], rax
lea rax, [rsi - 1]
jmp 0x14008623c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140083130
mov r8, rax
lea rcx, str.Error_waiting_for_named_pipe__s:__s
mov rdx, rdi
call fcn.14006c6b0
mov qword [r14], rax
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140083130
mov r8, rax
lea rcx, str.Unable_to_open_named_pipe__s:__s
mov rdx, rdi
call fcn.14006c6b0
mov qword [r14], rax
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov edx, 6
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea r8d, [rdx - 5]
mov qword [rsp + 0x20], rbp
call qword [0x140123418]
test eax, eax
je 0x1400861ed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140083130
mov rdx, rax
lea rcx, str.Unable_to_get_named_pipe_security_information:__s
call fcn.14006c6b0
mov qword [r14], rax
mov rax, 0xffffffffffffffff
jmp 0x14008623c
mov rcx, qword [rsp + 0x78]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14008622e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rdi
lea rcx, str.Owner_of_named_pipe__s_is_not_us
call fcn.14006c6b0
mov qword [r14], rax
mov rax, 0xffffffffffffffff
jmp 0x14008623c
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140086330
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rcx]
xor r8d, r8d
mov rbx, rcx
mov qword [rsp + 0x48], rax
test dl, dl
mov qword [rsp + 0x50], r8
mov eax, 0x40000003
mov qword [rsp + 0x40], 0x18
mov ecx, 0x40080003
mov r9d, 0xff
cmovne eax, ecx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov edx, eax
mov rcx, qword [rbx + 0x10]
mov dword [rsp + 0x30], r8d
mov r8d, 8
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x18], rax
setne al
add rsp, 0x60
pop rbx
ret

Function at 0x1400863d0
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movzx edi, dl
mov qword [rsp + 0x40], rbx
mov rsi, rcx
test dil, dil
je 0x1400863ef
xor dil, dil
jmp 0x14008641f
mov rcx, qword [rsi + 0x18]
lea rdx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x14008641f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
je 0x1400864a1
test eax, eax
je 0x14008641f
cmp eax, 0x217
jne 0x14008645a
mov rcx, qword [rsi + 0x48]
lea rdx, [0x1400863b0]
mov rbx, qword [rsi + 0x18]
mov r8, rbx
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
je 0x140086444
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, rsi
call fcn.140086330
test al, al
jne 0x1400863e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebx
call fcn.140083130
mov rdx, rax
lea rcx, str.Error_while_listening_to_named_pipe:__s
call fcn.14006c6b0
mov rcx, qword [rsi + 0x10]
mov rdi, rax
call fcn.140084880
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov r8, rax
mov qword [rsp + 0x20], rdi
mov r10, qword [rcx]
lea edx, [r9 + 1]
call qword [r10]
mov rcx, rdi
call fcn.140011ff0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400868f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbp, r9
mov qword [rsp + 0x40], r8
mov r13, rdx
mov qword [rsp + 0x38], 0
mov r14, rcx
xor edi, edi
call fcn.140086690
lea rdx, [rsp + 0x38]
mov rcx, rax
mov r15, rax
call fcn.140086040
mov rsi, rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140086a95
mov rcx, r14
call fcn.14006d070
mov r8, qword [r14 + 0x10]
xor ebx, ebx
test r8, r8
je 0x1400869a6
xor ecx, ecx
nop dword [rax]
mov rdx, qword [r14]
lea r9, [rsp + 0x30]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
sub r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140086a95
add ebx, dword [rsp + 0x30]
mov rax, qword [r14 + 0x10]
mov ecx, ebx
mov r8d, eax
cmp rcx, rax
jb 0x140086970
test rbp, rbp
jne 0x140086a37
call fcn.14006d190
mov rdi, rax
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140086a95
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140086750
mov ebx, eax
test eax, eax
je 0x1400869c0
cmp eax, 0xffffffff
je 0x140086a95
mov rcx, rdi
call fcn.14006d1c0
mov rcx, qword [rsp + 0x38]
xor edi, edi
mov qword [r13], rax
mov rax, qword [rsp + 0x40]
mov dword [rax], ebx
call fcn.140011ff0
mov rcx, r15
call fcn.140011ff0
jmp 0x140086ac0
xor r8d, r8d
lea edx, [r8 + 0x28]
lea ecx, [rdx - 0x27]
call fcn.140012100
xor r9d, r9d
lea rdx, [0x140086840]
mov r8, rax
mov rcx, rsi
mov rbx, rax
call fcn.140080e50
mov qword [rbx], rax
mov qword [rbx + 8], rsi
call fcn.14006d190
mov rcx, qword [rsp + 0x4c0]
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rbp
mov rcx, qword [rsp + 0x38]
call fcn.140011ff0
mov rcx, r15
call fcn.140011ff0
mov rax, rbx
jmp 0x140086ad8
mov rax, qword [rsp + 0x40]
mov qword [r13], 0
mov dword [rax], 0
mov rcx, qword [rsp + 0x38]
call fcn.140011ff0
mov rcx, r15
call fcn.140011ff0
cmp r12, 0xffffffffffffffff
je 0x140086ac9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x140086ad6
mov rcx, rdi
call fcn.14006d0a0
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14008ce70
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140086db0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x1401220f0], 0
jne 0x140086ee3
lea rcx, str.winspool.drv
mov qword [rsp + 0x20], rbx
call fcn.140082e60
lea rcx, str.spoolss.dll
mov rbx, rax
call fcn.140082e60
test rbx, rbx
je 0x140086e9d
lea rdx, str.EnumPrintersA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenPrinterA
mov rcx, rbx
mov qword [0x1401220b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ClosePrinter
mov rcx, rbx
mov qword [0x1401220b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StartDocPrinterA
mov rcx, rbx
mov qword [0x1401220c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EndDocPrinter
mov rcx, rbx
mov qword [0x1401220c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StartPagePrinter
mov rcx, rbx
mov qword [0x1401220d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EndPagePrinter
mov rcx, rbx
mov qword [0x1401220d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WritePrinter
mov rcx, rbx
mov qword [0x1401220e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140086ed0
xor eax, eax
mov qword [0x1401220b0], rax
mov qword [0x1401220b8], rax
mov qword [0x1401220c0], rax
mov qword [0x1401220c8], rax
mov qword [0x1401220d0], rax
mov qword [0x1401220d8], rax
mov qword [0x1401220e0], rax
mov rbx, qword [rsp + 0x20]
mov qword [0x1401220e8], rax
mov byte [0x1401220f0], 1
add rsp, 0x28
ret