joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007e924
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
and qword [rax - 0x38], 0
and qword [rax - 0x28], 0
and qword [rax + 0x20], 0
and qword [rax + 0x18], 0
and qword [rax - 0x20], 0
mov rbp, r8
mov r8d, 1
mov r12, rdx
mov dword [rax - 0x40], 0x8000000
xor r9d, r9d
mov edx, 0x80000000
mov dword [rbp], r8d
mov dword [rax - 0x48], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x10007e9aa
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x23d20139
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
jmp 0x10007eaa6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x10007e9cf
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x23d90139
jmp 0x10007e996
lea r8, [rsp + 0x48]
mov edx, eax
mov rcx, rdi
call fcn.10007c884
xor r9d, r9d
mov ebx, eax
test eax, eax
je 0x10007e9fb
mov edx, 0x23df0139
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10007ea96
and dword [rbp], 0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10007ea2a
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x23e50139
mov ebx, eax
jmp 0x10007e9ec
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.10007dddc
mov ebx, eax
test eax, eax
je 0x10007ea54
mov edx, 0x23eb0139
jmp 0x10007ea79
mov r9, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov edx, esi
mov rcx, rdi
call fcn.10007da28
mov ebx, eax
test eax, eax
je 0x10007ea86
mov edx, 0x23f00139
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x10007ea96
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10007eaa6
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x10007eab9
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x10007eace
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp rdi, 0xffffffffffffffff
je 0x10007eadd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x100082148
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x240], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x38], 0
lea rax, [0x10000fe48]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov esi, reloc.certcli.dll_Ordinal_256
mov ecx, 4
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdi, [0x10000c564]
test eax, eax
jne 0x1000821e3
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x6a2013a
mov r8d, eax
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
lea rcx, [0x10001ea10]
xor r9d, r9d
mov r8d, ebx
xor edx, edx
call fcn.1000ba5ac
jmp 0x100082204
mov ecx, 0x893
call fcn.1000ba420
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1000b99b0
mov rcx, rdi
call fcn.1000b99b0
xor ebx, ebx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov ecx, 2
mov dword [rsp + 0x20], esi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10008225c
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov r8d, ebx
mov edx, 0x6b1013a
xor ecx, ecx
mov edi, eax
call fcn.1000b51b8
lea rcx, [0x10001e8d0]
xor r9d, r9d
mov r8d, edi
xor edx, edx
call fcn.1000ba5ac
test ebx, ebx
jne 0x100082287
mov ebx, edi
jmp 0x100082283
mov ecx, 0x894
call fcn.1000ba420
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1000b99b0
mov rcx, rdi
call fcn.1000b99b0
mov rcx, rdi
call fcn.1000b99b0
test ebx, ebx
je 0x100082299
xor r9d, r9d
mov r8d, ebx
mov edx, 0x6d7013a
xor ecx, ecx
call fcn.1000b51b8
xor ecx, ecx
call fcn.100081e7c
mov edi, eax
test eax, eax
je 0x1000822b8
xor r9d, r9d
mov r8d, eax
mov edx, 0x6e0013a
xor ecx, ecx
call fcn.1000b51b8
test ebx, ebx
mov ecx, 1
cmove ebx, edi
call fcn.100081e7c
mov edi, eax
test eax, eax
je 0x1000822df
xor r9d, r9d
mov r8d, eax
mov edx, 0x6e7013a
xor ecx, ecx
call fcn.1000b51b8
test ebx, ebx
cmove ebx, edi
call fcn.100081c74
mov edi, eax
test eax, eax
je 0x100082301
xor r9d, r9d
mov r8d, eax
mov edx, 0x6f0013a
xor ecx, ecx
call fcn.1000b51b8
test ebx, ebx
lea r9, [rsp + 0x28]
lea rcx, [rsp + 0x30]
cmove ebx, edi
xor r8d, r8d
xor edx, edx
call fcn.1000818fc
mov edi, eax
test eax, eax
je 0x100082332
xor r9d, r9d
mov r8d, eax
mov edx, 0x704013a
xor ecx, ecx
call fcn.1000b51b8
test ebx, ebx
cmove ebx, edi
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x100082366
mov rax, qword [rdi]
xor esi, esi
jmp 0x100082358
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc rsi
mov rax, qword [rdi + rsi*8]
test rax, rax
jne 0x100082348
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x10008d0b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
and dword [rax - 0x18], 0
mov rsi, rcx
lea rcx, [0x10001f200]
mov rbp, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x10008d10a
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xe1c013b
mov ebx, eax
mov r8d, eax
jmp 0x10008d1cc
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x10008d13c
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xe25013b
mov ebx, eax
mov r8d, eax
jmp 0x10008d1cc
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x10008d168
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xe2e013b
mov ebx, eax
mov r8d, eax
jmp 0x10008d1cc
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x10008d1a6
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xe3d013b
mov ebx, eax
mov eax, 0x8007000d
test ebx, ebx
cmove ebx, eax
jmp 0x10008d1c9
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x10008d1d8
mov ebx, 0x8007000e
mov edx, 0xe45013b
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10008d1e8
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_memcpy
xor ebx, ebx
test ebx, ebx
je 0x10008d203
xor r9d, r9d
mov r8d, ebx
mov edx, 0xe5d013b
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10008d2c7
mov edx, dword [0x10011bd20]
test edx, edx
je 0x10008d20f
inc edx
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
xor ecx, ecx
mov dword [rsp + 0x28], 1
or dword [rsp + 0x20], 0xffffffff
call fcn.10004df1c
test eax, eax
je 0x10008d243
xor r9d, r9d
mov r8d, eax
mov edx, 0xe64013b
xor ecx, ecx
call fcn.1000b51b8
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea ecx, [r9 + 6]
mov edx, 0x10001
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rdi, rax
test rax, rax
jne 0x10008d27d
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xe6f013b
jmp 0x10008d2a4
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CertAddStoreToCollection]
test eax, eax
jne 0x10008d2b5
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xe79013b
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
jmp 0x10008d2b7
xor ebx, ebx
test rdi, rdi
je 0x10008d2c7
xor edx, edx
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x10008db74
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x30
and qword [rsp + 0x68], 0
mov dil, dl
mov bl, cl
test cl, cl
jne 0x10008db93
test dl, dl
je 0x10008dd2b
mov ecx, 0xb0b
call fcn.1000ba420
lea rcx, [0x1000048e8]
mov rdx, rax
call fcn.1000b99b0
mov ebp, 4
test bl, bl
je 0x10008dc51
lea rax, [rsp + 0x68]
lea rdx, [0x10001f280]
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10008dbf2
mov edx, 0x104b013b
lea rcx, [0x10001f280]
jmp 0x10008dc30
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea rdx, [0x10001f2f0]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10008dc3b
mov edx, 0x1057013b
lea rcx, [0x10001f2f0]
xor r9d, r9d
mov r8d, eax
call fcn.1000b51b8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x10008dc51
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x68], 0
test dil, dil
je 0x10008dd1b
and dword [rsp + 0x60], 0
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x68]
lea rdx, [0x10001f320]
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10008dca1
mov edx, 0x1070013b
lea rcx, [0x10001f320]
jmp 0x10008dd10
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea rbx, [0x1000123b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10008dcdd
mov edx, 0x1079013b
jmp 0x10008dd0d
mov rcx, qword [rsp + 0x68]
or dword [rsp + 0x50], 8
lea rax, [rsp + 0x50]
mov r9d, ebp
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10008dd1b
mov edx, 0x1083013b
mov rcx, rbx
xor r9d, r9d
mov r8d, eax
call fcn.1000b51b8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x10008dd2b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rdi
pop rbp
pop rbx
ret
Function at 0x100091278
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov r9d, edx
mov rdi, rcx
cmp dword [rcx], esi
je 0x1000912a2
mov r8d, dword [rcx]
mov rax, qword [rcx + 8]
xor edx, edx
div r8
mov rsi, rax
mov ecx, r9d
call fcn.1000ba420
mov ecx, 0x2d5
mov rbx, rax
call fcn.1000ba420
mov rdx, qword [rdi + 0x10]
mov r9, qword [rdi + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdx
mov edx, dword [rdi]
mov rcx, rax
mov r8, rbx
call fcn.1000b99b0
lea rcx, [0x10000c564]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1000b99b0
Function at 0x1000987e8
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
push rdi
sub rsp, 0x160
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov edi, r8d
mov r9d, edx
mov r8, rcx
xor ebx, ebx
mov qword [rax + 0x20], rbx
mov qword [rsp + 0x38], rbx
cmp rcx, rbx
je 0x100098891
mov eax, 0x7fffffff
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
mov edx, ebx
cmp rax, rbx
je 0x10009884b
cmp word [rcx], bx
je 0x100098850
add rcx, 2
mov qword [rsp + 0x48], rcx
dec rax
mov qword [rsp + 0x50], rax
jmp 0x10009882e
mov edx, 0x80070057
cmp edx, ebx
jge 0x100098891
mov dword [rsp + 0x20], 0x80070057
lea r9, [0x100020fe0]
mov r8d, Ordinal_140
lea rdx, [0x100021080]
lea rcx, [rsp + 0xa0]
call fcn.10003845c
lea rdx, [0x100109b30]
lea rcx, [rsp + 0xa0]
call sub.msvcrt.dll__CxxThrowException
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, ebx
jne 0x100098906
call sub.KERNEL32.dll_GetLastError
cmp eax, ebx
je 0x1000988c8
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
jmp 0x1000988cd
mov ecx, 0x80004005
mov dword [rsp + 0x20], ecx
lea r9, [0x100021520]
mov r8d, Ordinal_147
lea rdx, [0x100021080]
lea rcx, [rsp + reloc.certcli.dll_Ordinal_256]
call fcn.10003845c
lea rdx, [0x100109b30]
lea rcx, [rsp + reloc.certcli.dll_Ordinal_256]
call sub.msvcrt.dll__CxxThrowException
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, ebx
jne 0x100098983
call sub.KERNEL32.dll_GetLastError
cmp eax, ebx
je 0x100098945
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
jmp 0x10009894a
mov ecx, 0x80004005
mov dword [rsp + 0x20], ecx
lea r9, [0x1000215e0]
mov r8d, reloc.OLEAUT32.dll_SysAllocStringByteLen
lea rdx, [0x100021080]
lea rcx, [rsp + 0xd0]
call fcn.10003845c
lea rdx, [0x100109b30]
lea rcx, [rsp + 0xd0]
call sub.msvcrt.dll__CxxThrowException
mov ecx, Ordinal_36
call fcn.1000ef43c
mov qword [rsp + 0x58], rax
cmp rax, rbx
je 0x1000989b3
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.10009c6a4
jmp 0x1000989b6
mov rax, rbx
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x1000989fd
mov dword [rsp + 0x20], 0x8007000e
lea r9, [0x10001fb78]
mov r8d, Ordinal_155
lea rdx, [0x100021080]
lea rcx, [rsp + 0x130]
call fcn.10003845c
lea rdx, [0x100109b30]
lea rcx, [rsp + 0x130]
call sub.msvcrt.dll__CxxThrowException
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x30]
cmp rcx, rbx
je 0x100098a19
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x100098a38
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x120
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x100098a99
mov dword [rsp + 0x20], 0x80070057
lea r9, [0x100021648]
mov r8d, UnRegisterTypeLib
lea rdx, [0x100021080]
lea rcx, [rsp + 0x58]
call fcn.10003845c
lea rdx, [0x100109b30]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll__CxxThrowException
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptContextAddRef]
test eax, eax
jne 0x100098aff
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x100098ac1
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x100098ac6
mov ecx, 0x80004005
mov dword [rsp + 0x20], ecx
lea r9, [0x100021670]
mov r8d, 0xbb
lea rdx, [0x100021080]
lea rcx, [rsp + 0xb8]
call fcn.10003845c
lea rdx, [0x100109b30]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll__CxxThrowException
mov qword [rsp + 0x38], rbx
and qword [rsp + 0x130], 0
test rdi, rdi
jne 0x100098b19
mov edx, 0x8004
jmp 0x100098b29
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call fcn.10009a290
mov edx, dword [rax + 0x1c]
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x100098ba3
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x100098b65
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x100098b6a
mov ecx, 0x80004005
mov dword [rsp + 0x20], ecx
lea r9, [0x1000216c0]
mov r8d, 0xc3
lea rdx, [0x100021080]
lea rcx, [rsp + 0x88]
call fcn.10003845c
lea rdx, [0x100109b30]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll__CxxThrowException
mov ecx, Ordinal_36
call fcn.1000ef43c
mov qword [rsp + 0x48], rax
test rax, rax
je 0x100098bd1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, rax
call fcn.10009c6a4
jmp 0x100098bd3
xor eax, eax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x100098c1a
mov dword [rsp + 0x20], 0x8007000e
lea r9, [0x10001fb78]
mov r8d, Ordinal_203
lea rdx, [0x100021080]
lea rcx, [rsp + 0xe8]
call fcn.10003845c
lea rdx, [0x100109b30]
lea rcx, [rsp + 0xe8]
call sub.msvcrt.dll__CxxThrowException
and qword [rsp + 0x38], 0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1000a7c08
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
xor ebx, ebx
mov r14, r9
mov ebp, r8d
and qword [rax - 0x38], rbx
and dword [rax - 0x40], ebx
mov r12, rdx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rax - 0x48], 2
mov r13, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000a7ca0
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, dword [rsp + 0x90]
mov r9d, Ordinal_261
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x28], r13
mov edi, eax
mov dword [rsp + 0x20], eax
call fcn.1000afa28
xor r9d, r9d
mov r8d, edi
mov edx, 0xd200ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000a7d12
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000a7d00
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, dword [rsp + 0x90]
mov r9d, 0x11e
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x28], r13
mov edi, eax
mov dword [rsp + 0x20], eax
call fcn.1000afa28
xor r9d, r9d
mov r8d, edi
mov edx, 0xdf00ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000a7d05
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1000a7d1a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1000a92f0
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x390
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rbp, rdx
mov rsi, rcx
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
lea rdx, [rsp + 0x40]
mov ecx, 2
call fcn.1000b1b88
mov edi, eax
test eax, eax
je 0x1000a935c
xor r9d, r9d
mov r8d, eax
mov edx, 0x80600ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000a945c
mov dword [rsp + 0x50], reloc.certcli.dll_Ordinal_256
mov dword [rsp + 0x54], reloc.certcli.dll_Ordinal_260
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1000a93d0
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edi, eax
xor r9d, r9d
mov r8d, eax
mov edx, 0x81600ca
mov rcx, qword [rsp + 0x40]
call fcn.1000b51b8
jmp 0x1000a945c
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.1000db768
test eax, eax
jne 0x1000a9405
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edi, eax
xor r9d, r9d
mov r8d, eax
mov edx, 0x81c00ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000a945c
mov r8, rsi
mov rdx, qword [rsp + 0x48]
lea rcx, [0x100026770]
call fcn.1000e39ac
mov edi, eax
test eax, eax
je 0x1000a9433
xor r9d, r9d
mov r8d, eax
mov edx, 0x82300ca
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000a945c
mov r8, rbp
xor edx, edx
lea rcx, [0x1000268f0]
call fcn.1000e39ac
mov edi, eax
test eax, eax
je 0x1000a945c
xor r9d, r9d
mov r8d, eax
mov edx, 0x82900ca
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000a946d
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
cmp qword [rsp + 0x40], 0
je 0x1000a9486
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x40], 0
mov eax, edi
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + 0x390]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1000aa280
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rbp, rdx
lea rdx, [rax - 0x18]
lea r9d, [rbx + 2]
lea r8d, [rbx + 0xc]
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
cmp eax, ebx
jne 0x1000aa2c5
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xabf00ca
jmp 0x1000aa338
mov edi, ebx
cmp dword [rsp + 0x20], ebx
jbe 0x1000aa347
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetAce]
cmp eax, ebx
je 0x1000aa327
mov rdx, qword [rsp + 0x50]
cmp byte [rdx], bl
jne 0x1000aa2fb
add rdx, 8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, ebx
jne 0x1000aa305
inc edi
cmp edi, dword [rsp + 0x20]
jae 0x1000aa347
jmp 0x1000aa2cd
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteAce]
cmp eax, ebx
jne 0x1000aa347
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xad500ca
jmp 0x1000aa338
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xac700ca
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1000aa56c
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
mov r12, rdx
mov dword [r8], ebx
lea r9, [rax + 0x20]
lea rdx, [rax + 0x18]
lea r8, [rax - 0x38]
mov qword [rax - 0x38], rbx
mov dword [rax + 0x20], ebx
mov dword [rax + 0x18], ebx
mov esi, ebx
mov qword [rax - 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
cmp eax, ebx
jne 0x1000aa5c6
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xb6b00ca
jmp 0x1000aa68b
cmp dword [rsp + 0x70], ebx
je 0x1000aa65e
mov rcx, qword [rsp + 0x20]
cmp rcx, rbx
je 0x1000aa65e
xor eax, eax
lea rdx, [rsp + 0x30]
lea r9d, [rax + 2]
lea r8d, [rax + 0xc]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
cmp eax, ebx
jne 0x1000aa616
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xb7a00ca
jmp 0x1000aa68b
cmp dword [rsp + 0x30], ebx
jbe 0x1000aa65e
mov edi, ebx
mov rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_GetAce]
cmp eax, ebx
je 0x1000aa67a
mov rcx, qword [rsp + 0x28]
cmp byte [rcx], bl
je 0x1000aa642
cmp byte [rcx], 1
jne 0x1000aa653
add rcx, 8
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, ebx
jne 0x1000aa673
inc edi
cmp edi, dword [rsp + 0x30]
jb 0x1000aa61e
mov dword [rbp], esi
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov esi, 1
jmp 0x1000aa65b
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xb8500ca
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
mov ebx, eax
call fcn.1000b51b8
jmp 0x1000aa65e