joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3bc1c2a1a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
cmp rcx, 0xffffffffffffffff
setne al
test rdx, rdx
setne cl
test cl, al
je 0x3bc1c2aa8
test r8d, r8d
jle 0x3bc1c2aa8
mov r9d, 0
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp eax, 0xffffffff
je 0x3bc1c2a5c
test eax, eax
jle 0x3bc1c2a8b
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x3bc1c2a70
mov ebx, 0
jmp 0x3bc1c2a53
mov r9d, eax
mov r8, rsi
lea rdx, str.tcp_recv
lea rcx, str._E____s_____recv_failed_sock0x_llx_WSAgle_d__n
call fcn.3bc1c1292
jmp 0x3bc1c2a53
mov r8, rsi
lea rdx, str.tcp_recv
lea rcx, str._D____s_____Disconnected_sock0x_llx__n
call fcn.3bc1c1292
mov ebx, 0xffffffff
jmp 0x3bc1c2a53
mov dword [rsp + 0x20], r8d
mov r9, rdx
mov r8, rsi
lea rdx, str.tcp_recv
lea rcx, str._E____s_____Invalid_arguments_sock0x_llx_p0x_p_l_d__n
call fcn.3bc1c1292
mov ebx, 0xffffffff
jmp 0x3bc1c2a53

Function at 0x3bc1c2acd
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rbp, rdx
mov r12, r8
mov esi, r8d
cmp rcx, 0xffffffffffffffff
setne al
test rdx, rdx
setne dl
test dl, al
je 0x3bc1c2b7c
test r8d, r8d
jle 0x3bc1c2b7c
mov ebx, 0
cmp ebx, esi
jge 0x3bc1c2b49
movsxd rdx, ebx
add rdx, rbp
mov r9d, 0
mov r8d, esi
sub r8d, ebx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x3bc1c2b2a
add ebx, eax
jmp 0x3bc1c2b02
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
mov r8, rdi
lea rdx, str.tcp_send
lea rcx, str._E____s_____send_failed_sock0x_llx_WSAgle_d__n
call fcn.3bc1c1292
cmp ebx, r12d
jl 0x3bc1c2ba1
jg 0x3bc1c2b5d
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x20], ebx
mov r9d, r12d
mov r8, rdi
lea rdx, str.tcp_send
lea rcx, str._E____s________WTF____sock0x_llx_l_d_n_d__n
call fcn.3bc1c1292
jmp 0x3bc1c2b50
mov dword [rsp + 0x20], r12d
mov r9, rbp
mov r8, rdi
lea rdx, str.tcp_recv
lea rcx, str._E____s_____Invalid_arguments_sock0x_llx_p0x_p_l_d__n
call fcn.3bc1c1292
mov ebx, 0xffffffff
jmp 0x3bc1c2b50
mov ebx, 0xffffffff
jmp 0x3bc1c2b50

Function at 0x3bc1c2dde
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x3bc1c2e22
lea r8, [0x3bc1d4e7d]
lea rdx, str.net_init
lea rcx, [0x3bc1d4e82]
call fcn.3bc1c1292
mov eax, 0
add rsp, 0x1c0
pop rbx
ret
mov r8d, eax
lea rbx, str.net_init
mov rdx, rbx
lea rcx, str._E____s_____WSAStartup_failed_ret_d__n
call fcn.3bc1c1292
mov r8d, 1
mov rdx, rbx
lea rcx, [0x3bc1d4e5f]
call fcn.3bc1c1292
mov eax, 0x40000001
jmp 0x3bc1c2e19
Function at 0x3bc1c408b
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
mov rbp, r9
mov qword [rsp + 0x38], 0
test rcx, rcx
sete dl
test rbx, rbx
sete al
test dl, al
je 0x3bc1c40d0
test r8, r8
sete al
test r9, r9
sete dl
test al, al
je 0x3bc1c40d0
test dl, dl
jne 0x3bc1c417c
cmp qword [0x3bc1dd258], 0
je 0x3bc1c41a5
lea rcx, [rsp + 0x38]
call fcn.3bc1c2e90
test rax, rax
je 0x3bc1c41a5
test rdi, rdi
je 0x3bc1c4116
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x3bc1c4116
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, 1
je 0x3bc1c41a5
test rbx, rbx
je 0x3bc1c4135
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x3bc1c4135
mov rdx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x3bc1c41a5
test rsi, rsi
je 0x3bc1c4154
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x3bc1c4154
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x3bc1c41a5
test rbp, rbp
je 0x3bc1c40de
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x3bc1c40de
mov rdx, rbp
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x3bc1c40de
jmp 0x3bc1c41a5
mov dword [rsp + 0x20], 0x1fb
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str.__sid___NULL____s_sid___NULL____name___NULL____wname___NULL__
lea rdx, str.sam_group_find
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x3bc1c41b3
Capabilities:
Add user account group

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rbp, rdx
test rcx, rcx
je 0x3bc1c42ab
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea r8, [rbx + rbx]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x3bc1c42de
mov qword [rsp + 0x38], rax
mov rdx, rax
mov rcx, rdi
call fcn.3bc1ca0cb
mov r9d, 0
lea r8, [rsp + 0x38]
mov edx, 0
mov ecx, 0
call sub.NETAPI32.dll_NetLocalGroupAdd
mov ebx, eax
test eax, eax
setne dl
cmp eax, 0x8af
setne al
test dl, al
jne 0x3bc1c4308
mov ebx, 0
test rsi, rsi
je 0x3bc1c4259
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
mov edx, 0
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x3bc1c441c
mov esi, 0
test rbp, rbp
je 0x3bc1c426f
mov qword [rbp], rsi
test ebx, ebx
je 0x3bc1c446b
mov r9d, ebx
and r9d, 0x3fffffff
test rdi, rdi
je 0x3bc1c445f
mov r8, rdi
lea rdx, str.sam_group_add
lea rcx, str._E____s_____Failed_name_s_err_08x__n
call fcn.3bc1c1292
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x20], 0x215
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, [0x3bc1d5493]
lea rdx, str.sam_group_add
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov rsi, rdi
mov ebx, 0x40000004
jmp 0x3bc1c4266
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea r8, [rax + rax + 2]
lea rdx, [0x3bc1d4ea0]
lea rcx, [0x3bc1d4eb0]
call fcn.3bc1c1292
mov ebx, 0x40000002
jmp 0x3bc1c4266
mov r8d, ebx
lea rdx, str.sam_group_add
lea rcx, str._E____s_____NetLocalGroupAdd_failed_res_08lx__n
call fcn.3bc1c1292
cmp ebx, 0x20
ja 0x3bc1c433b
ja case.0x3bc1c4339.1
mov eax, ebx
lea rdx, [0x3bc1d552c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp ebx, 0x94
je 0x3bc1c43e0
cmp ebx, 0x94
jbe 0x3bc1c4379
cmp ebx, 0xb7
je 0x3bc1c4408
cmp ebx, 0x80070005
je 0x3bc1c4412
cmp ebx, 0xaa
je 0x3bc1c43a4
mov ebx, 0x40000001
jmp case.0x3bc1c4339.0
cmp ebx, 0x7f
ja 0x3bc1c4392
cmp ebx, 0x7e
jae 0x3bc1c43ea
cmp ebx, 0x50
jne 0x3bc1c43f4
mov ebx, 0x40000007
jmp case.0x3bc1c4339.0
cmp ebx, 0x91
jne 0x3bc1c43fe
mov ebx, 0x4000000d
jmp case.0x3bc1c4339.0
mov ebx, 0x4000000d
jmp case.0x3bc1c4339.0
mov ebx, 0x40000003
jmp case.0x3bc1c4339.0
mov ebx, 0x40000009
jmp case.0x3bc1c4339.0
mov ebx, 0x4000000d
jmp case.0x3bc1c4339.0
mov ebx, 0x40000001
jmp case.0x3bc1c4339.0
mov ebx, 0x40000008
jmp case.0x3bc1c4339.0
mov ebx, 0x4000000d
jmp case.0x3bc1c4339.0
mov ebx, 0x40000003
jmp case.0x3bc1c4339.0
mov ebx, 0x40000001
jmp case.0x3bc1c4339.0
mov ebx, 0x40000001
jmp case.0x3bc1c4339.0
mov ebx, 0x40000007
jmp case.0x3bc1c4339.0
mov ebx, 0x40000009
jmp case.0x3bc1c4339.0
call fcn.3bc1c2fbf
mov ebx, eax
test eax, eax
je 0x3bc1c4431
mov esi, 0
jmp 0x3bc1c4266
mov r9d, 0
mov r8, rdi
mov edx, 0
mov ecx, 0
call fcn.3bc1c408b
mov rsi, rax
test rax, rax
jne 0x3bc1c4266
mov ebx, 0x40000003
jmp 0x3bc1c4266
lea rdi, [0x3bc1d548e]
jmp 0x3bc1c428a
mov r9, qword [rsi + 0x18]
mov r8, qword [rsi + 8]
lea rdx, str.sam_group_add
lea rcx, str._I____s_____Done_name_s_s_sid_s__n
call fcn.3bc1c1292
jmp 0x3bc1c42a0
Function at 0x3bc1c448b
Capabilities:
Delete user account group

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x3bc1c4511
mov rdx, qword [rcx]
mov ecx, 0
call sub.NETAPI32.dll_NetLocalGroupDel
mov esi, eax
mov edi, 0
test edi, edi
sete dl
test esi, esi
setne al
test dl, al
je 0x3bc1c44c8
cmp esi, 0x8ac
jne 0x3bc1c4549
test edi, edi
je 0x3bc1c4668
mov eax, edi
and eax, 0x3fffffff
test rbx, rbx
je 0x3bc1c4657
mov r9, qword [rbx + 0x18]
mov r8, qword [rbx + 8]
mov dword [rsp + 0x20], eax
lea rdx, str.sam_group_del
lea rcx, str._E____s_____Failed_name_s_s_sid_s_err_08x__n
call fcn.3bc1c1292
test edi, edi
je 0x3bc1c4688
mov eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov dword [rsp + 0x20], 0x267
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._group___NULL_
lea rdx, str.sam_group_del
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov esi, 0
mov edi, 0x40000004
jmp 0x3bc1c44ae
mov r8d, esi
lea rdx, str.sam_group_del
lea rcx, str._E____s_____NetLocalGroupDel_failed_res_08lx__n
call fcn.3bc1c1292
cmp esi, 0x20
ja 0x3bc1c4586
ja case.0x3bc1c457a.1
mov eax, esi
lea rdx, [0x3bc1d5630]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov edi, 0x40000008
jmp 0x3bc1c44d0
cmp esi, 0x94
je 0x3bc1c461b
jbe 0x3bc1c45be
cmp esi, 0xb7
je 0x3bc1c4643
cmp esi, 0x80070005
je 0x3bc1c464d
cmp esi, 0xaa
je 0x3bc1c45e9
mov edi, 0x40000001
jmp 0x3bc1c44d0
cmp esi, 0x7f
ja 0x3bc1c45d7
cmp esi, 0x7e
jae 0x3bc1c4625
cmp esi, 0x50
jne 0x3bc1c462f
mov edi, 0x40000007
jmp 0x3bc1c44d0
cmp esi, 0x91
jne 0x3bc1c4639
mov edi, 0x4000000d
jmp 0x3bc1c44d0
mov edi, 0x4000000d
jmp 0x3bc1c44d0
mov edi, 0x4000000d
jmp 0x3bc1c44d0
mov edi, 0x40000009
jmp 0x3bc1c44d0
mov edi, 0x40000003
jmp 0x3bc1c44d0
mov edi, 0x40000001
jmp 0x3bc1c44d0
mov edi, 0x4000000d
jmp 0x3bc1c44d0
mov edi, 0x40000003
jmp 0x3bc1c44d0
mov edi, 0x40000001
jmp 0x3bc1c44d0
mov edi, 0x40000001
jmp 0x3bc1c44d0
mov edi, 0x40000007
jmp 0x3bc1c44d0
mov edi, 0x40000009
jmp 0x3bc1c44d0
lea r9, [0x3bc1d548e]
mov r8, r9
jmp 0x3bc1c44e8
mov edi, esi
mov r9, qword [rbx + 0x18]
mov r8, qword [rbx + 8]
lea rdx, str.sam_group_del
lea rcx, str._I____s_____Done_name_s_s_sid_s__n
call fcn.3bc1c1292
jmp 0x3bc1c44ff
call fcn.3bc1c2fbf
mov edi, eax
jmp 0x3bc1c4507
Function at 0x3bc1c4694
Capabilities:
Add user account to group

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x3bc1c4714
test rdx, rdx
je 0x3bc1c4744
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x38], rax
mov rdx, qword [rcx]
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x38]
mov r8d, 0
mov ecx, 0
call sub.NETAPI32.dll_NetLocalGroupAddMembers
mov edi, eax
test eax, eax
setne dl
cmp eax, 0x562
setne al
test dl, al
jne 0x3bc1c47b4
mov r9, qword [rsi + 0x18]
mov r8, qword [rbx + 0x18]
lea rdx, str.sam_member_add
lea rcx, str._I____s_____Done_group_s_user_s__n
call fcn.3bc1c1292
mov edi, 0
jmp 0x3bc1c47aa
mov dword [rsp + 0x20], 0x299
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._group___NULL_
lea rdx, str.sam_member_del
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov edi, 0x40000004
jmp 0x3bc1c4772
mov dword [rsp + 0x20], 0x29a
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._user___NULL_
lea rdx, str.sam_member_del
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov edi, 0x40000004
mov eax, edi
and eax, 0x3fffffff
test rsi, rsi
je 0x3bc1c4858
mov r9, qword [rsi + 0x18]
test rbx, rbx
je 0x3bc1c4864
mov r8, qword [rbx + 0x18]
mov dword [rsp + 0x20], eax
lea rdx, str.sam_member_add
lea rcx, str._E____s_____Failed_group_s_user_s_err_08x__n
call fcn.3bc1c1292
mov eax, edi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov r8d, edi
lea rdx, str.sam_member_add
lea rcx, str._E____s_____NetLocalGroupAddMembers_failed_res_08lx__n
call fcn.3bc1c1292
cmp edi, 0x20
ja 0x3bc1c47e3
ja case.0x3bc1c47e1.1
mov edi, edi
lea rdx, [0x3bc1d5774]
movsxd rax, dword [rdx + rdi*4]
add rax, rdx
jmp rax
cmp edi, 0x94
je case.0x3bc1c47e1.32
jbe 0x3bc1c480f
cmp edi, 0xb7
je 0x3bc1c481e
cmp edi, 0x80070005
je case.0x3bc1c47e1.5
cmp edi, 0xaa
je case.0x3bc1c47e1.32
mov edi, 0x40000001
jmp 0x3bc1c4772
cmp edi, 0x7f
ja 0x3bc1c4828
cmp edi, 0x7e
jae case.0x3bc1c47e1.2
cmp edi, 0x50
jne case.0x3bc1c47e1.1
mov edi, 0x40000007
jmp 0x3bc1c4772
cmp edi, 0x91
jne case.0x3bc1c47e1.1
mov edi, 0x4000000d
jmp 0x3bc1c4772
mov edi, 0x40000009
jmp 0x3bc1c4772
mov edi, 0x40000003
jmp 0x3bc1c4772
mov edi, 0x40000008
jmp 0x3bc1c4772
lea r9, [0x3bc1d548e]
jmp 0x3bc1c4786
lea r8, [0x3bc1d548e]
jmp 0x3bc1c4793
Function at 0x3bc1c4870
Capabilities:
Delete user account from group

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x3bc1c48f0
test rdx, rdx
je 0x3bc1c4920
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x38], rax
mov rdx, qword [rcx]
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x38]
mov r8d, 0
mov ecx, 0
call sub.NETAPI32.dll_NetLocalGroupDelMembers
mov edi, eax
test eax, eax
setne dl
cmp eax, 0x561
setne al
test dl, al
jne 0x3bc1c4990
mov r9, qword [rsi + 0x18]
mov r8, qword [rbx + 0x18]
lea rdx, str.sam_member_del
lea rcx, str._I____s_____Done_group_s_user_s__n
call fcn.3bc1c1292
mov edi, 0
jmp 0x3bc1c4986
mov dword [rsp + 0x20], 0x2d6
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._group___NULL_
lea rdx, str.sam_member_del
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov edi, 0x40000004
jmp 0x3bc1c494e
mov dword [rsp + 0x20], 0x2d7
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._user___NULL_
lea rdx, str.sam_member_del
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov edi, 0x40000004
mov eax, edi
and eax, 0x3fffffff
test rsi, rsi
je 0x3bc1c4a34
mov r9, qword [rsi + 0x18]
test rbx, rbx
je 0x3bc1c4a40
mov r8, qword [rbx + 0x18]
mov dword [rsp + 0x20], eax
lea rdx, str.sam_member_del
lea rcx, str._E____s_____Failed_group_s_user_s_err_08x__n
call fcn.3bc1c1292
mov eax, edi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov r8d, edi
lea rdx, str.sam_member_del
lea rcx, str._E____s_____NetLocalGroupDelMembers_failed_res_08lx__n
call fcn.3bc1c1292
cmp edi, 0x20
ja 0x3bc1c49bf
ja case.0x3bc1c49bd.1
mov edi, edi
lea rdx, [0x3bc1d5830]
movsxd rax, dword [rdx + rdi*4]
add rax, rdx
jmp rax
cmp edi, 0x94
je case.0x3bc1c49bd.32
jbe 0x3bc1c49eb
cmp edi, 0xb7
je 0x3bc1c49fa
cmp edi, 0x80070005
je case.0x3bc1c49bd.5
cmp edi, 0xaa
je case.0x3bc1c49bd.32
mov edi, 0x40000001
jmp 0x3bc1c494e
cmp edi, 0x7f
ja 0x3bc1c4a04
cmp edi, 0x7e
jae case.0x3bc1c49bd.2
cmp edi, 0x50
jne case.0x3bc1c49bd.1
mov edi, 0x40000007
jmp 0x3bc1c494e
cmp edi, 0x91
jne case.0x3bc1c49bd.1
mov edi, 0x4000000d
jmp 0x3bc1c494e
mov edi, 0x40000009
jmp 0x3bc1c494e
mov edi, 0x40000003
jmp 0x3bc1c494e
mov edi, 0x40000008
jmp 0x3bc1c494e
lea r9, [0x3bc1d548e]
jmp 0x3bc1c4962
lea r8, [0x3bc1d548e]
jmp 0x3bc1c496f
Function at 0x3bc1c4a4c
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
mov rbp, r9
mov qword [rsp + 0x38], 0
test rcx, rcx
sete dl
test rbx, rbx
sete al
test dl, al
je 0x3bc1c4a91
test r8, r8
sete al
test r9, r9
sete dl
test al, al
je 0x3bc1c4a91
test dl, dl
jne 0x3bc1c4b3d
cmp qword [0x3bc1dd250], 0
je 0x3bc1c4b66
lea rcx, [rsp + 0x38]
call fcn.3bc1c3748
test rax, rax
je 0x3bc1c4b66
test rdi, rdi
je 0x3bc1c4ad7
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x3bc1c4ad7
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, 1
je 0x3bc1c4b66
test rbx, rbx
je 0x3bc1c4af6
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x3bc1c4af6
mov rdx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x3bc1c4b66
test rsi, rsi
je 0x3bc1c4b15
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x3bc1c4b15
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x3bc1c4b66
test rbp, rbp
je 0x3bc1c4a9f
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x3bc1c4a9f
mov rdx, rbp
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x3bc1c4a9f
jmp 0x3bc1c4b66
mov dword [rsp + 0x20], 0x37e
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str.__sid___NULL____s_sid___NULL____name___NULL____wname___NULL__
lea rdx, str.sam_user_find
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x3bc1c581b
Capabilities:
Delete user account

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x3bc1c588c
mov rdx, qword [rcx]
mov ecx, 0
call sub.NETAPI32.dll_NetUserDel
mov esi, eax
test eax, eax
setne dl
cmp eax, 0x8ad
setne al
test dl, al
jne 0x3bc1c58fa
mov rcx, qword [rbx + 0x18]
mov r8d, 0
mov edx, 0
call qword [sym.imp.USERENV.dll_DeleteProfileA]
test eax, eax
je 0x3bc1c5a1a
mov r9, qword [rbx + 0x18]
mov r8, qword [rbx + 8]
lea rdx, str.sam_user_del
lea rcx, str._I____s_____Done_name_s_s_sid_s__n
call fcn.3bc1c1292
mov esi, 0
jmp 0x3bc1c58e9
mov dword [rsp + 0x20], 0x4d8
lea r9, str.H:_Projects_rdp_bot_codebase_sam.c
lea r8, str._user___NULL_
lea rdx, str.sam_user_del
lea rcx, [0x3bc1d5458]
call fcn.3bc1c1292
mov esi, 0x40000004
mov eax, esi
and eax, 0x3fffffff
test rbx, rbx
je 0x3bc1c5a0b
mov r9, qword [rbx + 0x18]
mov r8, qword [rbx + 8]
mov dword [rsp + 0x20], eax
lea rdx, str.sam_user_del
lea rcx, str._E____s_____Failed_name_s_s_sid_s_err_08x__n
call fcn.3bc1c1292
test esi, esi
je 0x3bc1c5a3b
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
mov r8d, esi
lea rdx, str.sam_user_del
lea rcx, str._E____s_____NetUserDel_failed_res_08lx__n
call fcn.3bc1c1292
cmp esi, 0x20
ja 0x3bc1c5934
ja case.0x3bc1c592b.1
mov esi, esi
lea rdx, [0x3bc1d5ddc]
movsxd rax, dword [rdx + rsi*4]
add rax, rdx
jmp rax
mov esi, 0x40000008
jmp 0x3bc1c58ba
cmp esi, 0x94
je 0x3bc1c59cf
cmp esi, 0x94
jbe 0x3bc1c5972
cmp esi, 0xb7
je 0x3bc1c59f7
cmp esi, 0x80070005
je 0x3bc1c5a01
cmp esi, 0xaa
je 0x3bc1c599d
mov esi, 0x40000001
jmp 0x3bc1c58ba
cmp esi, 0x7f
ja 0x3bc1c598b
cmp esi, 0x7e
jae 0x3bc1c59d9
cmp esi, 0x50
jne 0x3bc1c59e3
mov esi, 0x40000007
jmp 0x3bc1c58ba
cmp esi, 0x91
jne 0x3bc1c59ed
mov esi, 0x4000000d
jmp 0x3bc1c58ba
mov esi, 0x4000000d
jmp 0x3bc1c58ba
mov esi, 0x4000000d
jmp 0x3bc1c58ba
mov esi, 0x40000009
jmp 0x3bc1c58ba
mov esi, 0x40000003
jmp 0x3bc1c58ba
mov esi, 0x40000001
jmp 0x3bc1c58ba
mov esi, 0x4000000d
jmp 0x3bc1c58ba
mov esi, 0x40000003
jmp 0x3bc1c58ba
mov esi, 0x40000001
jmp 0x3bc1c58ba
mov esi, 0x40000001
jmp 0x3bc1c58ba
mov esi, 0x40000007
jmp 0x3bc1c58ba
mov esi, 0x40000009
jmp 0x3bc1c58ba
lea r9, [0x3bc1d548e]
mov r8, r9
jmp 0x3bc1c58d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.sam_user_del
lea rcx, str._W____s_____DeleteProfileA_failed_gle_lu__n
call fcn.3bc1c1292
jmp 0x3bc1c586a
call fcn.3bc1c387f
mov esi, eax
jmp 0x3bc1c58f1
Function at 0x3bc1c5d89
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test rcx, rcx
je 0x3bc1c5e18
test rdx, rdx
je 0x3bc1c5e51
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x3bc1c5e8a
mov ebp, 0
mov r12d, 0
test rdi, rdi
je 0x3bc1c5dcd
mov dword [rdi], ebp
test r12d, r12d
je 0x3bc1c5fc6
test rsi, rsi
je 0x3bc1c5de1
mov dword [rsi], 0xffffffff
mov r9d, r12d
and r9d, 0x3fffffff
test rbx, rbx
je 0x3bc1c5fba
mov r8, rbx
lea rdx, str.fs_attr_get
lea rcx, [0x3bc1d6130]
call fcn.3bc1c1292
mov eax, r12d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x20], 0x62
lea r9, str.H:_Projects_rdp_bot_codebase_fs.c
lea r8, [0x3bc1d6092]
lea rdx, str.fs_attr_get
lea rcx, [0x3bc1d60b0]
call fcn.3bc1c1292
mov ebp, 0xa0
mov r12d, 0x40000001
jmp 0x3bc1c5dc6
mov dword [rsp + 0x20], 0x63
lea r9, str.H:_Projects_rdp_bot_codebase_fs.c
lea r8, str._attr___NULL_
lea rdx, str.fs_attr_get
lea rcx, [0x3bc1d60b0]
call fcn.3bc1c1292
mov ebp, 0xa0
mov r12d, 0x40000001
jmp 0x3bc1c5dc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov r9d, eax
mov r8, rbx
lea rdx, str.fs_attr_get
lea rcx, str._E____s_____GetFileAttributesA_failed_path_s_gle_lu__n
call fcn.3bc1c1292
cmp ebp, 0x20
ja 0x3bc1c5ed0
ja case.0x3bc1c5ec6.1
mov eax, ebp
lea rdx, [0x3bc1d6180]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov r12d, ebp
jmp 0x3bc1c5dc6
cmp ebp, 0x94
je 0x3bc1c5f78
jbe 0x3bc1c5f09
cmp ebp, 0xb7
je 0x3bc1c5fa4
cmp ebp, 0x80070005
je 0x3bc1c5faf
cmp ebp, 0xaa
je 0x3bc1c5f36
mov r12d, 0x40000001
jmp 0x3bc1c5dc6
cmp ebp, 0x7f
ja 0x3bc1c5f23
cmp ebp, 0x7e
jae 0x3bc1c5f83
cmp ebp, 0x50
jne 0x3bc1c5f8e
mov r12d, 0x40000007
jmp 0x3bc1c5dc6
cmp ebp, 0x91
jne 0x3bc1c5f99
mov r12d, 0x4000000d
jmp 0x3bc1c5dc6
mov r12d, 0x4000000d
jmp 0x3bc1c5dc6
mov r12d, 0x40000003
jmp 0x3bc1c5dc6
mov r12d, 0x40000009
jmp 0x3bc1c5dc6
mov r12d, 0x4000000d
jmp 0x3bc1c5dc6
mov r12d, 0x40000001
jmp 0x3bc1c5dc6
mov r12d, 0x40000008
jmp 0x3bc1c5dc6
mov r12d, 0x4000000d
jmp 0x3bc1c5dc6
mov r12d, 0x40000003
jmp 0x3bc1c5dc6
mov r12d, 0x40000001
jmp 0x3bc1c5dc6
mov r12d, 0x40000001
jmp 0x3bc1c5dc6
mov r12d, 0x40000007
jmp 0x3bc1c5dc6
mov r12d, 0x40000009
jmp 0x3bc1c5dc6
lea rbx, [0x3bc1d606b]
jmp 0x3bc1c5df4
mov r9d, dword [rsi]
mov r8, rbx
lea rdx, str.fs_attr_get
lea rcx, str._D____s_____Done_path_s_attr_08lx__n
call fcn.3bc1c1292
jmp 0x3bc1c5e0a
Function at 0x3bc1c7025
Capabilities:
Delete file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x3bc1c716d
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x3bc1c7093
mov edi, 0
mov ebp, 0
test rsi, rsi
je 0x3bc1c7057
mov dword [rsi], edi
test ebp, ebp
je 0x3bc1c71ce
mov r9d, ebp
and r9d, 0x3fffffff
test rbx, rbx
je 0x3bc1c71c2
mov r8, rbx
lea rdx, str.fs_file_delete
lea rcx, [0x3bc1d6130]
call fcn.3bc1c1292
mov eax, ebp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov r9d, eax
mov r8, rbx
lea rdx, str.fs_file_delete
lea rcx, str._E____s_____DeleteFileA_failed_path_s_gle_lu__n
call fcn.3bc1c1292
cmp edi, 0x20
ja 0x3bc1c70d8
ja case.0x3bc1c70cf.1
mov eax, edi
lea rdx, [0x3bc1d6d84]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov ebp, edi
jmp 0x3bc1c7050
cmp edi, 0x94
je 0x3bc1c7186
jbe 0x3bc1c7110
cmp edi, 0xb7
je 0x3bc1c71ae
cmp edi, 0x80070005
je 0x3bc1c71b8
cmp edi, 0xaa
je 0x3bc1c713b
mov ebp, 0x40000001
jmp 0x3bc1c7050
cmp edi, 0x7f
ja 0x3bc1c7129
cmp edi, 0x7e
jae 0x3bc1c7190
cmp edi, 0x50
jne 0x3bc1c719a
mov ebp, 0x40000007
jmp 0x3bc1c7050
cmp edi, 0x91
jne 0x3bc1c71a4
mov ebp, 0x4000000d
jmp 0x3bc1c7050
mov ebp, 0x4000000d
jmp 0x3bc1c7050
mov ebp, 0x40000003
jmp 0x3bc1c7050
mov ebp, 0x40000009
jmp 0x3bc1c7050
mov ebp, 0x4000000d
jmp 0x3bc1c7050
mov ebp, 0x40000001
jmp 0x3bc1c7050
mov edi, 0xa0
mov ebp, 0x40000001
jmp 0x3bc1c7050
mov ebp, 0x40000008
jmp 0x3bc1c7050
mov ebp, 0x4000000d
jmp 0x3bc1c7050
mov ebp, 0x40000003
jmp 0x3bc1c7050
mov ebp, 0x40000001
jmp 0x3bc1c7050
mov ebp, 0x40000001
jmp 0x3bc1c7050
mov ebp, 0x40000007
jmp 0x3bc1c7050
mov ebp, 0x40000009
jmp 0x3bc1c7050
lea rbx, [0x3bc1d606b]
jmp 0x3bc1c7072
mov r8, rbx
lea rdx, str.fs_file_delete
lea rcx, [0x3bc1d6d69]
call fcn.3bc1c1292
jmp 0x3bc1c7088