joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140370560
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.14013bf08
movzx eax, al
test eax, eax
je 0x140370587
mov al, 1
jmp 0x14037067c
lea rcx, [rsp + 0x60]
call fcn.14014373a
movzx eax, al
test eax, eax
je 0x1403705c6
lea rcx, [rsp + 0x60]
call fcn.14014168d
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.14014168d
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
cmp qword [rcx], rax
jne 0x1403705c6
xor al, al
jmp 0x14037067c
lea rcx, [rsp + 0x60]
call fcn.140141a1b
mov ecx, eax
call fcn.140143640
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1403705eb
xor al, al
jmp 0x14037067c
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov r9d, 1
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140370630
xor al, al
jmp 0x14037067c
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140370659
xor al, al
jmp 0x14037067c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jne 0x14037066f
mov dword [rsp + 0x20], 1
jmp 0x140370677
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x14039d1a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x14039d1df
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x14039d1df
lea rdx, [0x14041b590]
mov rcx, qword [rsp + 0x40]
call fcn.14013ddda
test eax, eax
jne 0x14039d216
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20001004
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14039d205
xor eax, eax
jmp 0x14039d265
cmp dword [rsp + 0x20], 0
jne 0x14039d214
call qword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x14039d265
jmp 0x14039d261
lea rdx, [0x14041b5b0]
mov rcx, qword [rsp + 0x40]
call fcn.14013ddda
test eax, eax
jne 0x14039d253
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x2000000b
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14039d251
xor eax, eax
jmp 0x14039d265
jmp 0x14039d261
mov rcx, qword [rsp + 0x40]
call fcn.1401391c7
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14039d320
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
movzx eax, word [rsp + 0x50]
and eax, 0x3ff
movzx eax, ax
bts eax, 0xa
movzx eax, ax
mov dword [rsp + 0x24], eax
call fcn.14013b2b0
add rax, 0x98
mov qword [rsp + 0x30], rax
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20000001
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14039d383
xor eax, eax
jmp 0x14039d3c3
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x50], eax
je 0x14039d3be
cmp dword [rsp + 0x58], 0
je 0x14039d3be
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.14039c8f0
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.1401399bf
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
jne 0x14039d3be
xor eax, eax
jmp 0x14039d3c3
mov eax, 1
add rsp, 0x48
ret
Function at 0x140006822
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, [0x14000773d]
call sub.msvcrt.dll_getenv
jmp 0x1400068db
lea rcx, [0x140007741]
lea rdx, str._q3.p__p__:3:p__q___37081.1____6_22p__s
mov r8, rax
mov rax, qword [0x1400081ce]
call rax
mov rsi, rax
lea rdi, [0x140007741]
lea r12, [0x140006d6d]
push r12
push rdi
push rsi
push r14
push rbp
mov rbp, rsp
sub rsp, 0x1b0
sub edi, 0x670c
mov qword [rbp - 0x4b], rcx
movzx edi, byte [rbp - 0x98]
add eax, ecx
mov dword [rbp - 0x4d], esi
call fcn.140006a24
sub edi, dword [0x14000700c]
sub r9, r10
mov qword [rbp - 0x1b], rax
test r14, rax
jb 0x140006977
mov edi, esi
mov di, dx
sub edx, 0xb810
mov edi, dword [rbp - 0x135]
movzx ecx, dh
mov r8, r14
mov rcx, qword [rbp - 0x17e]
sub r10, 0xc897
mov ecx, ecx
sub ax, dx
sub edi, eax
mov qword [rbp - 0x9b], r8
mov rsi, r14
sub dword [rbp - 0xd4], edi
mov eax, dword [rbp - 0x20]
cmp esi, 0x6daa9ebc
js 0x14000698e
add r8, r14
cmp eax, dword [0x140007008]
jne 0x140006999
or r10, rdx
mov qword [rbp - 0x11c], r10
xor esi, dword [rbp - 0x33]
mov edx, dword [rbp - 0x17e]
mov qword [rbp - 0x136], rdi
movzx ecx, dh
movzx esi, dh
movzx ecx, di
test ecx, edi
jne 0x1400069f7
mov rax, qword [rbp - 0x85]
mov esi, dword [rbp - 0x5f]
mov dword [rbp - 0x125], ecx
mov qword [rbp - 0xef], r14
mov qword [rbp - 0x16a], rsi
sub rdi, qword [rbp - 0xef]
mov rsi, qword [rbp - 0xad]
mov r9, qword [rbp - 0x12c]
mov qword [rbp - 0x11b], rdi
mov dword [0x140007008], edi
test edi, eax
je 0x140006a17
add rcx, r8
add edx, eax
mov qword [rbp - 0xad], r10
mov r10, r11
lea rdi, [rbp - 0x112]
sub r11, 0x1932
leave
pop r14
pop rsi
pop rdi
ret
Function at 0x1400015ec
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x1a0
mov rax, qword [0x140022338]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor esi, esi
mov qword [rsp + 0x58], rsi
mov dword [0x140022d00], esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea edx, [rsi + 8]
lea r8d, [rsi + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x1400017d9
mov rcx, rax
call fcn.1400011c8
lea r14d, [rsi + 1]
mov qword [0x140022f18], rax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
nop dword [rax + rax]
lea r15, [0x140018168]
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], r15
call fcn.140001378
test eax, eax
js 0x1400017be
mov rcx, qword [rsp + 0x68]
lea eax, [rsi + 3]
mov qword [rsp + 0x40], rsi
or edi, 0xffffffff
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
nop dword [rax + rax]
test eax, eax
js 0x1400017be
lea rax, [rsp + 0x58]
mov r8d, r14d
lea r9, [0x140019270]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x1400191d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop dword [rax + rax]
test eax, eax
js 0x140001784
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
mov ebx, r14d
call fcn.140009060
test eax, eax
je 0x140001745
cmp dword [rbp - 0x80], 2
jne 0x140001745
cmp dword [rsp + 0x74], 6
jne 0x140001745
cmp dword [rsp + 0x78], esi
cmove ebx, esi
mov rcx, qword [rsp + 0x58]
lea r8, [rbx + 1]
mov rax, qword [rcx]
movabs r10, 0x8c45af813654d170
mov rax, qword [rax + 0x18]
mov edx, r14d
call qword [vtable.H_MA8HI.0]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [vtable.H_MA8HI.0]
cmp byte [0x140022ce0], sil
jne 0x1400017c0
mov rbx, qword [0x140022f18]
mov dword [rsp + 0x50], esi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rdx, rax
lea r8, [rsp + 0x50]
call fcn.140003d50
cmp al, r14b
jne 0x1400017d3
mov rcx, rbx
call fcn.140001964
mov edi, eax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], r15
call fcn.1400021c0
mov eax, edi
jmp 0x1400017de
mov edi, dword [rsp + 0x50]
jmp 0x1400017c0
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140015d30
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140006838
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
xor r14d, r14d
test rax, rax
je 0x1400068c6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400068c6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400068b6
cmp rbx, rcx
jae 0x1400068c6
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400068a1
cmp rbx, rcx
jae 0x1400068c6
cmp word [rbx], r14w
je 0x1400068c6
mov rax, rbx
jmp 0x1400068c8
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140006c48
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rdi
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov ebx, r8d
mov r15d, edx
mov r14, rcx
cmp dword [rcx], 0
jne 0x140006d5b
mov rax, qword [0x1400221e0]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, [0x1400221e0]
mov rax, qword [rax + 0x18]
call qword [vtable.H_MA8HI.0]
add rax, 0x18
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x7c], ebx
lea r8, [rsp + 0xe0]
mov qword [rsp + 0x68], r8
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x80]
call fcn.140007768
nop
lea rcx, [r14 + 0x38]
lea rdx, [rsp + 0x78]
call fcn.140007d94
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006d11
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [vtable.H_MA8HI.0]
xor eax, eax
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rbx
ret
cmp ebx, dword [rcx + 0x90]
ja 0x140006d11
test ebx, ebx
je 0x140006d11
sub ebx, 1
je 0x140006d82
sub ebx, 1
je 0x140006d7b
sub ebx, 1
mov ecx, 0x4000000
jmp 0x140006d87
mov ecx, 0x3000000
jmp 0x140006d87
mov ecx, 0x2000000
lea rbx, [rsp + 0xe0]
mov qword [rsp + 0x78], rbx
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x140006e45
cmp qword [r14 + 0x18], 0
je 0x140006e45
cmp qword [r14 + 0x28], 0
je 0x140006e45
movabs r10, 0xb590be7e50d71a70
mov r8, rbx
mov rdx, r9
call qword [vtable.H_MA8HI.0]
mov rbx, rax
mov rdi, qword [r14 + 0x18]
movabs r10, 0xabf9976974561970
mov rax, qword [r14 + 0x28]
call qword [vtable.H_MA8HI.0]
movabs r10, 0xb63137745ad55970
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and dword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, str.CPanther::WdsSetupLogMessageW
mov qword [rsp + 0x30], rax
lea rax, str.onecore_base_ntsetupopktoolsdismlibutilpantherwrapper.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x103
xor r9d, r9d
lea r8, [0x1400199c8]
mov edx, r15d
mov rcx, rbx
mov rax, rdi
call qword [vtable.H_MA8HI.0]
jmp 0x140006ec6
mov rax, qword [0x1400221e0]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, [0x1400221e0]
mov rax, qword [rax + 0x18]
call qword [vtable.H_MA8HI.0]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r8, rbx
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x68]
call fcn.140007768
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop dword [rax + rax]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006ec6
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [vtable.H_MA8HI.0]
nop
jmp 0x140006d11

Function at 0x140009468
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
lea rdx, [0x140019b00]
mov rbx, rcx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
test rax, rax
jne 0x140009497
add rsp, 0x20
pop rbx
ret
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadResource]
Function at 0x1400095b4
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140022338]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x140022fbc]
test eax, eax
jne 0x1400096b8
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
jne 0x140009623
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x30]
xor eax, eax
mov edx, dword [rsp + 0x24]
mov dword [0x140022fbc], eax
sub ecx, 1
je 0x140009694
cmp ecx, 1
jne 0x1400096b8
cmp edx, 5
jne 0x140009682
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x14000967b
sub eax, ecx
je 0x140009661
cmp eax, ecx
je 0x140009657
lea eax, [rdx + 0xf]
jmp 0x1400096d6
mov edx, 0x10
lea ecx, [rdx - 0xf]
jmp 0x140009669
mov edx, 8
lea ecx, [rdx - 6]
xor eax, eax
cmp word [rsp + 0x134], cx
cmovae eax, edx
or eax, 4
jmp 0x1400096d6
mov eax, 4
jmp 0x1400096d6
cmp edx, 4
ja 0x1400096d1
mov ecx, 2
mov eax, ecx
mov dword [0x140022fbc], ecx
cmp edx, 4
jne 0x1400096b8
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1400096ab
cmp ecx, 0xa
je 0x1400096ab
cmp ecx, 0x5a
jne 0x1400096b8
mov ecx, 1
mov eax, ecx
mov dword [0x140022fbc], ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140015d30
add rsp, 0x158
ret
mov eax, 0x20
mov dword [0x140022fbc], eax
jmp 0x1400096b8

Function at 0x140009ae0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rdi, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [rax + rax]
test rax, rax
jne 0x140009b14
lea ecx, [rax + 0x19]
int 0x29
test byte [rsp + 0x44], 0x44
je 0x140009b73
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
mov r9d, dword [rsp + 0x54]
xor edx, edx
mov r8d, r9d
neg r8
and r8, rbx
lea ecx, [r9 - 1]
mov eax, ecx
and ecx, ebx
and eax, edi
add eax, ecx
dec rax
add rax, r9
div r9
xor edx, edx
mov rcx, rax
mov rax, rdi
div r9
add rcx, rax
mov eax, ecx
test ecx, ecx
je 0x140009b73
lock or dword [r8], 0
add r8, r9
sub rax, 1
jne 0x140009b65
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140009b8c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r8, dword [0x14000003c]
lea rbx, [0x140000000]
add r8, rbx
mov rsi, rdx
mov ebp, ecx
cmp dword [r8 + 0x84], 0xd
jbe 0x140009c0b
mov r9d, dword [r8 + 0xf0]
test r9d, r9d
je 0x140009c0b
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
mov r10d, dword [r9 + rbx + 0xc]
add rcx, rax
movzx r11d, word [r8 + 6]
xor r9d, r9d
test r11d, r11d
je 0x140009c0b
mov r8d, dword [rcx + 0xc]
cmp r10d, r8d
jb 0x140009bff
mov edx, dword [rcx + 8]
lea eax, [rdx + r8]
cmp r10d, eax
jb 0x140009c27
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140009bea
mov dword [rsi], 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdi, r8
add rdi, rbx
je 0x140009c0b
cmp dword [0x1400230e8], 0
jne 0x140009c5c
cmp dword [rcx + 0x24], 0
mov dword [0x1400230e8], 1
jl 0x140009c4f
mov ecx, 0x19
int 0x29
mov rcx, rdi
mov rbx, rdx
call fcn.140009ae0
jmp 0x140009c5f
mov rbx, rdx
mov r9, rsi
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop dword [rax + rax]
test eax, eax
jne 0x140009c11
lea ecx, [rax + 0x19]
int 0x29
jmp 0x140009c11
Function at 0x14000a44c
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x140022338]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
mov word [rbp + 0x4b], 0x500
lea rax, [rbp + 0x2f]
mov dword [rbp + 0x47], ebx
mov qword [r11 - 0x48], rax
lea rcx, [rbp + 0x3f]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov esi, ebx
mov dword [rsp + 0x28], ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
mov qword [rbp + 0x37], rbx
mov dword [rbp + 0x3f], ebx
mov word [rbp + 0x43], 0x500
mov qword [rbp + 0x2f], rbx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x14000a517
mov rdx, qword [rbp + 0x2f]
lea r8, [rbp + 0x27]
xor ecx, ecx
mov dword [rbp + 0x27], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x14000a4f7
mov esi, dword [rbp + 0x27]
jmp 0x14000a505
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
jmp 0x14000a525
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
test esi, esi
je 0x14000a53e
mov eax, 1
jmp 0x14000a5ad
lea rax, [rbp + 0x37]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x47]
mov dword [rsp + 0x48], ebx
mov dl, 1
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
lea r8d, [r9 + 0x13]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x14000a5ab
mov rdx, qword [rbp + 0x37]
lea r8, [rbp + 0x27]
xor ecx, ecx
mov dword [rbp + 0x27], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x37]
test eax, eax
cmovne ebx, dword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140015d30
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000a7dc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140022338]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, [0x140019f00]
lea rcx, [0x140022d10]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
nop dword [rax + rax]
xor esi, esi
test eax, eax
je 0x14000a90c
mov edx, 0x104
lea rax, [rsp + 0x20]
mov ecx, edx
cmp word [rax], si
je 0x14000a85e
add rax, 2
sub rcx, 1
jne 0x14000a84f
sub rdx, rcx
mov rax, rcx
neg rax
sbb r8, r8
and r8, rdx
test rcx, rcx
je 0x14000a90c
lea rdx, [r8 - 3]
mov rcx, rdi
mov r8d, 0x7ffffffe
lea rax, [rdi - 1]
cmp rax, r8
ja 0x14000a905
cmp rdx, r8
ja 0x14000a909
sub rdx, rcx
lea r10, [rsp + 0x20]
sub r10, rbx
mov r9, rcx
mov r8, rbx
lea rax, [rdx + r9]
test rax, rax
je 0x14000a8c3
movzx eax, word [r10 + r8]
test ax, ax
je 0x14000a8c3
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x14000a8a2
test r9, r9
lea rax, [r8 - 2]
cmovne rax, r8
mov word [rax], si
je 0x14000a90c
mov rdx, rcx
mov rcx, rbx
call fcn.14000a1e8
test eax, eax
js 0x14000a90c
movabs r10, 0xc25d1ef85a5bc870
mov rax, qword [0x140023050]
lea rcx, [rsp + 0x20]
call qword [vtable.H_MA8HI.0]
mov eax, 1
jmp 0x14000a90e
test edi, edi
je 0x14000a90c
mov word [rbx], si
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140015d30
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000a93c
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdi, r9
mov r13, r8
mov rbx, rdx
mov r12, rcx
xor r15d, r15d
mov qword [r11 - 0x50], r15
or rax, 0xffffffffffffffff
mov qword [r11 - 0x40], rax
mov r14, rax
mov qword [r11 - 0x48], rax
xor eax, eax
mov qword [r11 - 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movabs r10, 0x9e590e123c577270
and qword [r11 - 0x68], rax
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov rax, qword [0x140023028]
call qword [vtable.H_MA8HI.0]
mov rsi, rax
mov qword [rsp + 0x58], rax
cmp rax, r14
je 0x14000aadc
test r12, r12
je 0x14000a9f5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x64], r12
and dword [rsp + 0x6c], r15d
mov rdi, qword [0x140023048]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
neg r12
sbb rax, rax
lea rdx, [rsp + 0x60]
and rax, rdx
movabs r10, 0xcd1817f67cdf9270
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rsi
mov edx, ebx
mov rax, rdi
call qword [vtable.H_MA8HI.0]
test eax, eax
je 0x14000aacc
lea rdx, [rsp + 0x44]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
je 0x14000aacc
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x44]
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
nop dword [rax + rax]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000aacc
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop dword [rax + rax]
mov r15, rax
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xa8]
test r15, r15
jne 0x14000ab46
cmp r14, 0xffffffffffffffff
je 0x14000ab01
movabs r10, 0xce709ee7125b9070
mov rcx, r14
mov rax, qword [0x140023038]
call qword [vtable.H_MA8HI.0]
cmp rsi, 0xffffffffffffffff
je 0x14000ab41
movabs r10, 0xce709ee7125b9070
mov rcx, rsi
mov rax, qword [0x140023038]
call qword [vtable.H_MA8HI.0]
cmp rsi, 0xffffffffffffffff
je 0x14000ab41
movabs r10, 0xc25d1ef85a5bc870
mov rcx, rbx
mov rax, qword [0x140023050]
call qword [vtable.H_MA8HI.0]
test r15, r15
je 0x14000ab6c
test rdi, rdi
je 0x14000ab53
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x14000ab63
mov qword [rax], r14
test r13, r13
je 0x14000ab6c
mov qword [r13], rsi
mov rax, r15
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000ae4c
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
or edi, 0xffffffff
cmp dword [0x140022350], edi
jne 0x14000ae79
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
nop dword [rax + rax]
mov dword [0x140022350], eax
cmp eax, edi
je 0x14000ae9c
cmp dword [0x140022358], edi
jne 0x14000ae97
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
nop dword [rax + rax]
mov dword [0x140022358], eax
cmp eax, edi
je 0x14000ae9c
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret