joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039ca0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
and qword [rcx + 8], 0
mov rsi, rdx
mov r8, qword [rcx + 0x10]
mov rbx, rcx
mov r14d, 1
test r8, r8
je 0x140039d0a
xor ecx, ecx
sub r8, rcx
mov r9, rsi
add rcx, qword [rbx]
mov rdx, r14
call fcn.140067750
mov rcx, rsi
mov rdi, rax
call fcn.1400970bc
test eax, eax
jne 0x140039d5d
test rdi, rdi
je 0x140039d0a
mov rcx, qword [rbx + 8]
add rcx, rdi
mov qword [rbx + 8], rcx
mov r8, qword [rbx + 0x10]
cmp rcx, r8
jb 0x140039cd1
mov rax, qword [rbx + 0x10]
xor edi, edi
cmp qword [rbx + 8], rax
jne 0x140039d25
mov rcx, rsi
call fcn.14009714c
cmp eax, 0xffffffff
cmovne edi, r14d
mov rcx, qword [rbx]
lea r8, [rbx + 0x18]
mov rdx, qword [rbx + 8]
mov eax, edi
and qword [r8 + 8], 0
and dword [r8 + 0x18], 0
mov qword [r8], rcx
mov qword [r8 + 0x10], rdx
mov qword [r8 + 0x20], r8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov eax, 2
jmp 0x140039d47

Function at 0x14003d38c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov rax, qword [0x1400f2118]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbp, r9
movsxd rsi, r8d
mov r13, rdx
mov r14, rcx
xor r12d, r12d
call qword [rcx]
mov rbx, rax
test rax, rax
je 0x14003d3d4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + htons]
mov edi, dword [rsp + 0x120]
test edi, edi
jle 0x14003d454
mov r15, rsi
movsxd rax, edi
cmp rax, qword [r14 + 0x28]
jbe 0x14003d3f1
mov esi, dword [r14 + 0x28]
jmp 0x14003d3f3
mov esi, edi
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + htons]
mov rcx, qword [rbx + 8]
mov r8, r15
mov rdx, r13
call fcn.140008428
mov rcx, qword [rbx + 8]
mov edx, r12d
call fcn.1400085bc
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [rax + 0x18]
inc r12d
movsxd r9, esi
test esi, esi
jle 0x14003d44b
lea rdx, [rsp + 0x20]
mov rcx, rbp
sub rdx, rbp
mov r8, r9
mov al, byte [rcx + rdx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x14003d43d
add rbp, r9
sub edi, esi
test edi, edi
jg 0x14003d3e2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400581b0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14003e1e4
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.14000b70c
Function at 0x14003fb88
Capabilities:
Hash data using sha1 via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x38
movdqa xmm4, xmmword [0x1400c8bd0]
movdqu xmm5, xmmword [rdx]
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rcx]
pshufb xmm5, xmm4
movaps xmmword [rax - 0x18], xmm6
movdqu xmm6, xmmword [rdx + 0x10]
paddd xmm0, xmm5
movaps xmmword [rax - 0x28], xmm7
movdqu xmm7, xmmword [rdx + 0x30]
sha1rnds4 xmm1, xmm0, 0
movdqu xmm0, xmmword [rcx]
movdqa xmm2, xmm1
pshufb xmm7, xmm4
pshufb xmm6, xmm4
movaps xmmword [rsp], xmm8
movdqu xmm8, xmmword [rdx + 0x20]
sha1nexte xmm0, xmm6
sha1rnds4 xmm2, xmm0, 0
pshufb xmm8, xmm4
sha1msg1 xmm5, xmm6
sha1nexte xmm1, xmm8
sha1msg1 xmm6, xmm8
movdqa xmm3, xmm2
movdqa xmm4, xmm8
sha1rnds4 xmm3, xmm1, 0
sha1nexte xmm2, xmm7
sha1msg1 xmm8, xmm7
pxor xmm4, xmm5
movdqa xmm0, xmm3
sha1rnds4 xmm0, xmm2, 0
sha1msg2 xmm4, xmm7
sha1nexte xmm3, xmm4
pxor xmm8, xmm4
movdqa xmm1, xmm0
sha1rnds4 xmm1, xmm3, 0
movdqa xmm5, xmm7
movdqa xmm2, xmm1
sha1msg1 xmm7, xmm4
pxor xmm5, xmm6
sha1msg2 xmm5, xmm4
sha1nexte xmm0, xmm5
sha1rnds4 xmm2, xmm0, 1
sha1msg2 xmm8, xmm5
sha1nexte xmm1, xmm8
sha1msg1 xmm4, xmm5
movdqa xmm0, xmm2
pxor xmm7, xmm5
sha1rnds4 xmm0, xmm1, 1
sha1msg2 xmm7, xmm8
sha1nexte xmm2, xmm7
movdqa xmm1, xmm0
movdqa xmm3, xmm8
pxor xmm3, xmm4
movdqa xmm4, xmm7
sha1msg2 xmm3, xmm7
sha1rnds4 xmm1, xmm2, 1
sha1nexte xmm0, xmm3
sha1msg1 xmm5, xmm8
sha1msg1 xmm8, xmm7
movdqa xmm2, xmm1
pxor xmm4, xmm5
sha1msg2 xmm4, xmm3
sha1rnds4 xmm2, xmm0, 1
sha1nexte xmm1, xmm4
sha1msg1 xmm7, xmm3
pxor xmm8, xmm3
movdqa xmm0, xmm2
sha1msg2 xmm8, xmm4
sha1rnds4 xmm0, xmm1, 1
sha1msg1 xmm3, xmm4
pxor xmm7, xmm4
movdqa xmm1, xmm0
sha1msg2 xmm7, xmm8
movdqa xmm6, xmm8
sha1nexte xmm2, xmm8
pxor xmm6, xmm3
sha1rnds4 xmm1, xmm2, 2
sha1msg1 xmm4, xmm8
sha1msg2 xmm6, xmm7
sha1nexte xmm0, xmm7
sha1msg1 xmm8, xmm7
movdqa xmm2, xmm1
movdqa xmm5, xmm7
sha1rnds4 xmm2, xmm0, 2
sha1nexte xmm1, xmm6
movdqa xmm0, xmm2
pxor xmm8, xmm6
sha1rnds4 xmm0, xmm1, 2
movdqa xmm3, xmm0
pxor xmm5, xmm4
sha1msg1 xmm7, xmm6
sha1msg2 xmm5, xmm6
sha1nexte xmm2, xmm5
sha1rnds4 xmm3, xmm2, 2
sha1msg2 xmm8, xmm5
sha1nexte xmm0, xmm8
pxor xmm7, xmm5
movdqa xmm1, xmm3
sha1rnds4 xmm1, xmm0, 2
sha1msg2 xmm7, xmm8
sha1nexte xmm3, xmm7
movdqa xmm4, xmm8
movdqa xmm2, xmm1
sha1rnds4 xmm2, xmm3, 3
movdqa xmm3, xmm7
movdqa xmm0, xmm2
sha1msg1 xmm6, xmm5
sha1msg1 xmm5, xmm8
sha1msg1 xmm8, xmm7
pxor xmm4, xmm6
pxor xmm3, xmm5
movaps xmm6, xmmword [rax - 0x18]
sha1msg2 xmm4, xmm7
sha1nexte xmm1, xmm4
sha1rnds4 xmm0, xmm1, 3
movdqa xmm1, xmm0
pxor xmm8, xmm4
sha1msg2 xmm3, xmm4
sha1nexte xmm2, xmm3
sha1rnds4 xmm1, xmm2, 3
sha1msg2 xmm8, xmm3
sha1nexte xmm0, xmm8
sha1msg1 xmm7, xmm4
movdqa xmm2, xmm1
pxor xmm7, xmm3
sha1rnds4 xmm2, xmm0, 3
sha1msg2 xmm7, xmm8
movaps xmm8, xmmword [rsp]
movdqa xmm0, xmm2
sha1nexte xmm2, xmmword [rcx + 0x10]
sha1nexte xmm1, xmm7
movaps xmm7, xmmword [rax - 0x28]
sha1rnds4 xmm0, xmm1, 3
paddd xmm0, xmmword [rcx]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + 0x10], xmm2
add rsp, 0x38
ret
Function at 0x1400404e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, qword [rcx + 0x1a0]
mov rbp, r8
mov rdi, qword [rcx + 0x198]
mov rax, rsi
sub rax, rdi
mov r14, rdx
mov rbx, rcx
cmp r8, rax
jb 0x140040604
mov rax, rdi
xor edi, edi
sub rsi, rax
lea rcx, [rbx + 0xc8]
add rcx, rax
mov r8, rsi
mov rdx, r14
call fcn.140059500
sub rbp, rsi
mov r8, rdi
add r14, rsi
mov rdx, rbx
mov r9d, 5
lea r10, [rbx + 0xce]
mov esi, edi
add r10, r8
mov r11, rdx
cmp r8, qword [rbx + 0x1a0]
jae 0x1400405d4
movzx eax, byte [r10]
add r8, 8
movzx ecx, byte [r10 + 1]
inc esi
shl rcx, 8
or rcx, rax
movzx eax, byte [r10 - 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r10 - 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r10 - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r10 - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r10 - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r10 - 6]
shl rcx, 8
add r10, 8
or rcx, rax
xor qword [r11], rcx
add r11, 0x28
cmp esi, 5
jb 0x14004055d
add rdx, 8
sub r9, 1
jne 0x14004054e
mov rcx, rbx
call fcn.1400407fc
mov qword [rbx + 0x198], rdi
mov rax, rdi
mov rsi, qword [rbx + 0x1a0]
cmp rbp, rsi
jae 0x140040524
lea rcx, [rbx + 0xc8]
mov r8, rbp
add rcx, rdi
mov rdx, r14
call fcn.140059500
add qword [rbx + 0x198], rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400407fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x1400f2118]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r15d, 0x18
lea rsi, [0x1400cf3a0]
mov r10, rcx
mov r12d, 0xcccccccd
lea r14d, [r15 - 0x13]
lea rdx, [rsp + 0x20]
mov r8, r14
lea rcx, [r10 + 0x18]
mov rax, qword [rcx - 0x18]
xor rax, qword [rcx - 0x10]
xor rax, qword [rcx - 8]
xor rax, qword [rcx + 8]
xor rax, qword [rcx]
lea rcx, [rcx + 0x28]
mov qword [rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x140040853
lea r9d, [r8 + 4]
mov rbx, r14
mov r8, r10
lea ecx, [r9 - 3]
mov eax, r12d
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, r12d
mul r9d
mov r11, qword [rsp + rcx*8 + 0x20]
mov ecx, r9d
shr edx, 2
rol r11, 1
lea eax, [rdx + rdx*4]
sub ecx, eax
mov rax, r14
xor r11, qword [rsp + rcx*8 + 0x20]
xor qword [r8], r11
add r8, 8
sub rax, 1
jne 0x1400408b3
inc r9d
sub rbx, 1
jne 0x140040881
xor r11d, r11d
lea rbx, [0x1400cf460]
mov rdi, r10
xor ebp, ebp
lea r12d, [r11 + r11]
xor r14d, r14d
mov edx, dword [rbx]
mov eax, 0xcccccccd
mov r8, qword [rdi]
mov ecx, edx
neg ecx
and edx, 0x3f
and ecx, 0x3f
mov r9, r8
shr r9, cl
add rbx, 4
mov cl, dl
add rdi, 8
shl r8, cl
lea ecx, [r12 + rbp*2]
add ecx, ebp
or r9, r8
mul ecx
inc ebp
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
add rax, r14
add r14, 5
mov qword [rsp + rax*8 + 0x20], r9
cmp ebp, 5
jb 0x1400408df
inc r11d
mov r14d, 5
cmp r11d, r14d
jb 0x1400408d6
xor ebx, ebx
lea r11d, [r14 - 3]
mov edi, r14d
mov r12d, 0xcccccccd
mov ecx, r11d
lea r9, [rsp + 0x20]
mov eax, r12d
mul r11d
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov r8d, ecx
lea rax, [rcx + rcx*4]
lea r9, [r9 + rax*8]
mov eax, r12d
lea ecx, [r11 - 1]
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
lea rcx, [rsp + 0x20]
sub rax, r8
lea rbp, [rax + rax*4]
mov rax, rbx
sub rax, r8
lea rdx, [rax + rax*4]
shl rdx, 3
mov r8, rdx
sub r8, rcx
mov rcx, r14
add r8, r10
mov rax, qword [r9 + rbp*8]
not rax
and rax, qword [r9]
xor rax, qword [rdx + r9]
mov qword [r8 + r9], rax
lea r9, [r9 + 8]
sub rcx, 1
jne 0x1400409a5
inc r11d
inc rbx
sub rdi, 1
jne 0x14004094b
mov rax, qword [rsi]
add rsi, 8
xor qword [r10], rax
sub r15, 1
jne 0x140040847
mov edx, 0xc8
lea rcx, [rsp + 0x20]
call fcn.14004db88
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400581b0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140049268
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400f2118]
xor rax, rsp
mov qword [rsp + 0x10], rax
xor r8d, r8d
mov r10, rdx
mov r9d, r8d
or r11d, 0xffffffff
mov rdx, rcx
mov cl, byte [r9 + rdx]
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x14004929e
movsx eax, cl
sub eax, 0x41
jmp 0x1400492e0
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x1400492ad
movsx eax, cl
sub eax, 0x47
jmp 0x1400492e0
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400492bc
movsx eax, cl
add eax, 4
jmp 0x1400492e0
cmp cl, 0x2b
jne 0x1400492c8
mov eax, 0x3e
jmp 0x1400492e0
cmp cl, 0x2f
jne 0x1400492d4
mov eax, 0x3f
jmp 0x1400492e0
cmp cl, 0x3d
jne 0x14004935e
mov eax, r11d
mov dword [rsp + r9*4], eax
inc r9
cmp r9, 4
jl 0x14004928b
mov edx, dword [rsp]
cmp edx, r11d
je 0x14004935e
cmp dword [rsp + 4], r11d
je 0x14004935e
mov ecx, dword [rsp + 8]
mov eax, dword [rsp + 0xc]
cmp ecx, r11d
jne 0x140049316
cmp eax, r11d
jne 0x14004935e
mov r8d, 1
jmp 0x140049321
cmp eax, r11d
setne r8b
add r8d, 2
shl edx, 6
and eax, 0x3f
or edx, dword [rsp + 4]
and ecx, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [r10], al
cmp r8d, 1
jbe 0x14004934f
mov ecx, edx
shr ecx, 8
mov byte [r10 + 1], cl
cmp r8d, 2
jbe 0x140049359
mov byte [r10 + 2], dl
mov eax, r8d
jmp 0x140049360
xor eax, eax
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400581b0
add rsp, 0x28
ret

Function at 0x14004a0a8
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9, rcx
test r8, r8
je 0x14004a0cd
sub rdx, rcx
movzx ecx, byte [rdx + r9]
movzx eax, byte [r9]
inc r9
xor ecx, eax
or r10d, ecx
sub r8, 1
jne 0x14004a0b6
mov ecx, 0x100
mov eax, ecx
sub eax, r10d
cmp eax, ecx
setae al
ret
Function at 0x14004b67c
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r8d, dword [rdx + 8]
lea r9, [rsp + 0x48]
mov rdx, qword [rdx]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret
Function at 0x14004c7ec
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
xor r8d, r8d
mov rbx, rcx
mov edx, 0x1048
mov ebp, r9d
lea ecx, [r8 + 1]
call fcn.140008cbc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r14, rax
and dword [rax], 0
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r14 + 0x10], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
and word [r14 + 0x21], 0
mov qword [r14 + 0x18], rax
mov rax, qword [0x1400f3118]
mov qword [r14 + 0x1040], rdi
mov byte [r14 + 0x20], 0
mov qword [r14 + 0x28], rsi
mov dword [r14 + 0x30], ebp
test rax, rax
jne 0x14004c88c
lea rcx, [0x14004c578]
call fcn.140049130
mov qword [0x1400f3118], rax
mov rdx, r14
mov rcx, rax
call fcn.14004831c
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [r14 + 8]
and dword [rsp + 0x20], 0
lea r8, [0x14004c8dc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov byte [r14 + 0x23], 1
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14004ca70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
xor r8d, r8d
mov rbx, rcx
mov edx, 0x1048
mov ebp, r9d
lea r15d, [r8 + 1]
mov ecx, r15d
call fcn.140008cbc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r14, rax
mov dword [rax], r15d
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r14 + 0x10], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ebx, ebx
mov qword [r14 + 0x28], rdi
lea rcx, [r14 + 0x50]
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], ebx
call fcn.140049678
mov rax, qword [0x1400f3118]
mov dword [r14 + 0x78], ebx
mov qword [r14 + 0x80], rsi
mov dword [r14 + 0x30], ebp
test rax, rax
jne 0x14004cb1b
lea rcx, [0x14004c578]
call fcn.140049130
mov qword [0x1400f3118], rax
mov rdx, r14
mov rcx, rax
call fcn.14004831c
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [r14 + 8]
lea r8, [0x14004cb68]
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14004d5a8
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1400f3138], 0
jne 0x14004d5ff
lea rcx, str.secur32.dll
call fcn.14004d7a8
lea rcx, str.sspicli.dll
mov rbx, rax
call fcn.14004d7a8
test rbx, rbx
je 0x14004d5ed
lea rdx, str.GetUserNameExA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14004d5ef
xor eax, eax
mov qword [0x1400f3130], rax
mov byte [0x1400f3138], 1
jmp 0x14004d606
mov rax, qword [0x1400f3130]
test rax, rax
je 0x14004d66b
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
xor edx, edx
lea edi, [rdx + 8]
mov ecx, edi
call rax
mov ecx, dword [rsp + 0x30]
lea edx, [rdi - 7]
xor r8d, r8d
call fcn.140008cbc
lea r8, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
mov rbx, rax
call qword [0x1400f3130]
test al, al
mov rcx, rbx
setne dil
test al, al
je 0x14004d661
mov edx, 0x40
call fcn.140059928
test rax, rax
je 0x14004d666
mov byte [rax], 0
jmp 0x14004d666
call fcn.140008bbc
test dil, dil
jne 0x14004d6c0
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [rsp + 0x30]
mov r8d, 0x100
test eax, eax
cmove ecx, r8d
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r8 + 1]
call fcn.140008cbc
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
setne dil
test eax, eax
jne 0x14004d6c0
mov rcx, rbx
call fcn.140008bbc
neg dil
sbb rax, rax
and rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14004d7a8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400f3150], 0
mov rbx, rcx
jne 0x14004d821
mov edx, dword [0x1400f3158]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, eax
cmp rax, qword [0x1400f3158]
jb 0x14004d821
mov edi, 1
mov rcx, qword [0x1400f3150]
lea rdx, [0x1400f3158]
mov byte [rsp + 0x28], 0
mov r9, rax
mov r8, rdi
mov qword [rsp + 0x20], rdi
call fcn.140008bd0
mov edx, dword [0x1400f3158]
mov rcx, rax
mov qword [0x1400f3150], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, eax
cmp rax, qword [0x1400f3158]
jae 0x14004d7dd
mov rcx, qword [0x1400f3150]
lea rdx, [0x1400d07f4]
xor r9d, r9d
mov r8, rbx
call fcn.1400497fc
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rdi
mov rbx, rax
call fcn.140008bbc
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400502b8
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1400f2118]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rcx
mov edx, 0x107
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [0x1400d4124]
lea rcx, [rsp + 0x190]
call fcn.140084250
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140050344
mov edx, 0x140
lea rcx, [rsp + 0x30]
call rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14005031d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 4
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
call rbx
mov edi, 0x20
lea rcx, [rsp + 0x170]
mov edx, edi
call fcn.1400505a0
test al, al
je 0x14005038d
mov edx, edi
lea rcx, [rsp + 0x170]
call rbx
mov edx, edi
lea rcx, [rsp + 0x170]
call fcn.14004db88
mov rcx, rbx
call fcn.140054ce0
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400581b0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2b0
pop rdi
ret

Function at 0x1400503b8
Capabilities:
Get memory capacity

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1400f2118]
xor rax, rsp
mov qword [rbp + 0x47], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 8
lea rdx, [rbp - 0x29]
mov qword [rbp - 0x29], rax
lea ecx, [r8 + 1]
call fcn.14003c560
call qword [sym.imp.USER32.dll_GetCapture]
mov r8d, 8
lea rdx, [rbp - 0x29]
mov qword [rbp - 0x29], rax
lea ecx, [r8 + 2]
call fcn.14003c560
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov r8d, 8
lea rdx, [rbp - 0x29]
mov qword [rbp - 0x29], rax
lea ecx, [r8 + 3]
call fcn.14003c560
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov r8d, 4
lea rdx, [rbp - 0x21]
mov dword [rbp - 0x21], eax
lea ecx, [r8 + 8]
call fcn.14003c560
lea rcx, [rbp - 0x19]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 8
lea rdx, [rbp - 0x19]
lea ecx, [r8 + 5]
call fcn.14003c560
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r8d, 0x38
lea rdx, [rbp - 0x11]
lea ecx, [r8 - 0x32]
call fcn.14003c560
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rbp + 0x37]
lea rax, [rbp + 0x3f]
lea r8, [rbp + 0x2f]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov r8d, 0x20
lea rdx, [rbp + 0x27]
lea ecx, [r8 - 0x12]
call fcn.14003c560
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rbp + 0x37]
lea rax, [rbp + 0x3f]
lea r8, [rbp + 0x2f]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov r8d, 0x20
lea rdx, [rbp + 0x27]
lea ecx, [r8 - 0x11]
call fcn.14003c560
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400581b0
add rsp, 0xb0
pop rbp
ret
Function at 0x1400506e0
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r15
sub rsp, 0x40
and qword [rax - 0x28], 0
mov rsi, rdx
mov ebp, 0x40000000
xor r9d, r9d
mov dword [rax - 0x30], ebp
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rax - 0x38], 3
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
or r15, 0xffffffffffffffff
jmp 0x14005076a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x1400507bc
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
je 0x1400507a6
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, r15
je 0x140050724
call fcn.1400532e0
mov rbp, rax
mov rcx, rbx
test rax, rax
jne 0x1400507e6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004da2c
lea rcx, str.Unable_to_get_user_SID:__s
mov rdx, rax
call fcn.14004989c
jmp 0x1400507db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004da2c
lea rcx, str.Error_waiting_for_named_pipe__s:__s
jmp 0x1400507d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004da2c
lea rcx, str.Unable_to_open_named_pipe__s:__s
mov rdx, rdi
mov r8, rax
call fcn.14004989c
mov qword [rsi], rax
mov rax, r15
jmp 0x14005087f
mov edx, 6
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x78]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8d, [rdx - 5]
call qword [0x1400f6590]
test eax, eax
je 0x14005083c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004da2c
lea rcx, str.Unable_to_get_named_pipe_security_information:__s
jmp 0x14005079c
mov rcx, qword [rsp + 0x78]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140050871
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rdi
lea rcx, str.Owner_of_named_pipe__s_is_not_us
jmp 0x14005079f
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x140050968
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov bl, dl
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x18]
call fcn.140059b30
mov rax, qword [rdi]
mov r9d, 0xff
and dword [rsp + 0x50], 0
mov r8d, 8
mov rcx, qword [rdi + 0x10]
neg bl
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
sbb edx, edx
and dword [rsp + 0x30], 0
mov eax, 0x1000
and edx, 0x80000
mov dword [rsp + 0x28], eax
add edx, 0x40000003
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x18
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, qword [rsp + 0x70]
cmp rax, 0xffffffffffffffff
mov qword [rdi + 0x18], rax
setne al
add rsp, 0x60
pop rdi
ret

Function at 0x140050a10
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov bl, dl
mov rsi, rcx
test bl, bl
je 0x140050a2c
xor bl, bl
jmp 0x140050a5c
mov rcx, qword [rsi + 0x18]
lea rdx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x140050a5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
je 0x140050ade
test eax, eax
je 0x140050a5c
cmp eax, 0x217
jne 0x140050a97
mov rcx, qword [rsi + 0x48]
lea rdx, [0x1400509f4]
mov rdi, qword [rsi + 0x18]
mov r8, rdi
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
je 0x140050a81
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, rsi
call fcn.140050968
test al, al
jne 0x140050a24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call fcn.14004da2c
mov rdx, rax
lea rcx, str.Error_while_listening_to_named_pipe:__s
call fcn.14004989c
mov rcx, qword [rsi + 0x10]
mov rbx, rax
call fcn.14004efdc
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov r8, rax
mov qword [rsp + 0x20], rbx
mov r10, qword [rcx]
lea edx, [r9 + 1]
call qword [r10]
mov rcx, rbx
call fcn.140008bbc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret