joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a5a90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebp, ecx
mov rcx, rdi
lea rdx, [0x14011612c]
mov rsi, r8
call fcn.1400c4f7c
lea rcx, str.hid_E___R__KfgEtON8TCBe
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__hInYhe31iA5C
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp rbx, rdi
je 0x1400a5b2e
lea rdx, [0x140116168]
mov rcx, rdi
call fcn.1400c4f7c
cmp rax, rdi
je 0x1400a5b2e
xor eax, eax
test ebp, ebp
jne 0x1400a5b04
mov rdx, rsi
mov rcx, rdi
call fcn.140008ffc
jmp 0x1400a5b41
test rdi, rdi
je 0x1400a5b41
test rsi, rsi
je 0x1400a5b41
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], ax
jne 0x1400a5b12
test r8, r8
je 0x1400a5b41
mov rdx, rdi
mov rcx, rsi
call fcn.140011a60
jmp 0x1400a5b41
lea r8, [rdi + 4]
mov rcx, rsi
lea rdx, str.__UNC_s
call fcn.140012124
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a8858
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor r8d, r8d
lea r9, [rbp + 0x18]
mov edi, ecx
lea edx, [r8 + 1]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
xor esi, esi
mov dword [rbp - 0x30], 0x720050
lea rcx, str.hid_P___r__SKxfdhLzCd1Y
mov word [rbp - 0xc], si
mov ebx, eax
mov dword [rbp - 0x2c], 0x760069
mov dword [rbp - 0x28], 0x6c0069
mov dword [rbp - 0x24], 0x670065
mov dword [rbp - 0x20], 0x200065
mov dword [rbp - 0x1c], 0x250027
mov dword [rbp - 0x18], 0x270075
mov dword [rbp - 0x14], 0x4f0020
mov dword [rbp - 0x10], 0xa004b
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__TJ1IvaB9eCMz
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test ebx, ebx
js 0x1400a88f2
mov edx, edi
lea rcx, [rbp - 0x30]
call fcn.14000b314
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400a8f40
Capabilities:
Create pipe
Create process on windows
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1010]
mov eax, 0x1110
call fcn.1400e31d0
sub rsp, rax
xor esi, esi
mov dword [rbp - 0x80], reloc.ODBC32.dll_SQLAllocHandle
and qword [rbp - 0x78], rsi
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x70], 1
xor edx, edx
lea rcx, [rbp - 0x60]
lea r8d, [rsi + 0x68]
call fcn.1400c5520
xor eax, eax
lea rcx, str.hid_E___R__LjNtmBl9u75Q
and qword [rbp + 0x1048], rax
xorps xmm0, xmm0
and qword [rsp + 0x60], rax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__p4jha1UWU60u
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call fcn.1400c9ff8
mov r14, rax
test rax, rax
je 0x1400a914f
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x1048]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400a9147
mov rcx, qword [rbp + 0x1048]
lea edx, [rsi + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
bts dword [rbp - 0x24], 8
mov rax, qword [rbp - 8]
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
test rdi, rdi
je 0x1400a903a
xor r8d, r8d
lea rcx, [rsp + 0x60]
mov rdx, rdi
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x1400a912b
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, r14
lea rax, [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rcx, rdi
and qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8000400
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
test eax, eax
je 0x1400a911b
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbp], 0
mov edi, 0x1000
and qword [rbp - 8], 0
jmp 0x1400a90d2
mov eax, dword [rbp + 0x1040]
test eax, eax
je 0x1400a90f7
xor ebx, ebx
test eax, eax
je 0x1400a90d2
movzx edx, byte [rbp + rbx + 0x10]
lea rcx, [0x140101850]
call fcn.14000b314
inc ebx
cmp ebx, dword [rbp + 0x1040]
jb 0x1400a90b7
mov rcx, qword [rbp + 0x1048]
lea r9, [rbp + 0x1040]
and qword [rsp + 0x20], 0
lea rdx, [rbp + 0x10]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a90a7
mov rcx, qword [rsp + 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400a912b
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rbp + 0x1048]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400a9147
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.1400ca07c
lea r11, [rsp + 0x1110]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400aa658
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
movdqa xmm0, xmmword [0x140123770]
mov r15, rcx
movdqa xmm1, xmmword [0x1401233f0]
lea rcx, str.hid________lybU5olESXGI
movdqa xmmword [rbp - 0x79], xmm0
xor ebx, ebx
movdqa xmm0, xmmword [0x1401240a0]
mov sil, dl
and dword [rbp - 0x35], ebx
movdqa xmmword [rbp - 0x69], xmm1
movdqa xmm1, xmmword [0x1401234c0]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmmword [rbp - 0x49], xmm1
mov dword [rbp - 0x39], 0xa
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140123820]
lea rcx, str.hid________OfcyHF7Q5daC
movdqa xmm1, xmmword [0x140123cc0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x140123c70]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x140123de0]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x140123370]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x140122d80]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmmword [rbp + 0x27], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__eXuTNqRD3HK7
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [rbp + 0x77]
lea rcx, [rbp + 0x7f]
call fcn.14000ea78
test eax, eax
je 0x1400aa7b7
cmp dword [rbp + 0x77], 1
mov r14, qword [rbp + 0x7f]
jne 0x1400aa7af
lea rcx, [rbp - 0x79]
call fcn.14000b314
test sil, sil
je 0x1400aa774
mov rdi, r15
mov r8d, dword [rdi]
lea rcx, str._____hhu__0x_08x_n
movzx edx, bl
call fcn.14000b314
inc bl
lea rdi, [rdi + 4]
cmp bl, sil
jb 0x1400aa757
lea rcx, [rbp - 0x29]
call fcn.14000b314
xor dil, dil
mov ebx, 1
test sil, sil
je 0x1400aa7af
test ebx, ebx
je 0x1400aa7af
mov rcx, qword [r14 + 0x68]
mov r8b, dil
movzx eax, dil
mov r9d, dword [r15 + rax*4]
bswap r9d
call fcn.14000e804
and ebx, eax
inc dil
cmp dil, sil
jb 0x1400aa78a
mov rcx, r14
call fcn.14000d3ec
mov eax, ebx
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400aaccc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8w
mov r11, r9
movzx r10d, dl
xor r9b, r9b
shl r10d, 0x10
mov rsi, rcx
or r10d, eax
movabs rax, 0x2004000000
lea edi, [r10 + r10]
xor r10b, r10b
or rdi, rax
xor r8b, r8b
movzx edx, r8b
mov rax, rdi
inc r8b
lea ecx, [rdx + 0xd]
shr rax, cl
lea ecx, [rdx + 1]
and al, 1
xor r10b, al
mov rax, rdi
shr rax, cl
and al, 1
xor r9b, al
cmp r8b, 0xc
jb 0x1400aad0a
xor eax, eax
movzx ecx, r10b
and ecx, 1
shl rcx, 0x19
test r9b, r9b
sete al
or rcx, rax
or rdi, rcx
test r11, r11
je 0x1400aad54
mov qword [r11], rdi
mov rcx, rdi
mov dword [rsi], 0x90625062
shr rcx, 0x28
call fcn.1400aac94
movzx ebx, al
mov rcx, rdi
or ebx, 0x1d00
shr rcx, 0x24
shl ebx, 8
call fcn.1400aac94
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x20
shl ebx, 8
call fcn.1400aac94
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x1c
mov dword [rsi + 4], ebx
call fcn.1400aac94
movzx ebx, al
mov rcx, rdi
shr rcx, 0x18
shl ebx, 8
call fcn.1400aac94
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x14
shl ebx, 8
call fcn.1400aac94
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x10
shl ebx, 8
call fcn.1400aac94
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0xc
mov dword [rsi + 8], ebx
call fcn.1400aac94
movzx ebx, al
mov rcx, rdi
shr rcx, 8
shl ebx, 8
call fcn.1400aac94
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 4
shl ebx, 8
call fcn.1400aac94
movzx eax, al
mov cl, dil
or ebx, eax
shl ebx, 8
call fcn.1400aac94
movzx eax, al
or ebx, eax
mov dword [rsi + 0xc], ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400aae44
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
and dword [rax + 8], 0
mov rdi, rdx
xor r10b, r10b
mov r11, rcx
movabs r8, 0xff80000000000000
movzx esi, r10b
lea rdx, [rsp + 8]
mov ecx, 9
mov r9, rdi
sub ecx, esi
shl ecx, 2
shr r9, cl
xor cl, cl
and r9b, 0xf
xor bl, bl
mov al, r9b
shr al, cl
inc cl
and al, 1
xor byte [rdx], al
xor bl, al
inc rdx
cmp cl, 4
jb 0x1400aae8b
imul eax, esi, 0xfffffffb
inc r10b
movzx edx, bl
lea ecx, [rax + 0x32]
shl rdx, cl
lea ecx, [rax + 0x33]
movzx eax, r9b
shl rax, cl
or rdx, rax
or r8, rdx
cmp r10b, 0xa
jb 0x1400aae6a
movzx eax, byte [rsp + 0xa]
movzx ecx, byte [rsp + 0xb]
mov rbx, qword [rsp + 0x10]
add ecx, ecx
mov rsi, qword [rsp + 0x18]
or ecx, eax
movzx eax, byte [rsp + 9]
add ecx, ecx
mov rdi, qword [rsp + 0x20]
or ecx, eax
movzx eax, byte [rsp + 8]
add ecx, ecx
or ecx, eax
mov dword [r11], 0x148040
lea eax, [rcx + rcx]
or r8, rax
mov rax, r8
mov dword [r11 + 8], r8d
shr rax, 0x20
mov dword [r11 + 4], eax
ret
Function at 0x1400ab474
Capabilities:
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
lea rcx, str.hid_E___R__k4NMy59OMV3q
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__dyGRhy7HpF0O
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor esi, esi
mov qword [rsp + 0x48], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8d, [rax*2 + 2]
mov dword [rsp + 0x88], esi
cmp qword [0x140138a68], rsi
je 0x1400ab5dc
cmp qword [0x140138a28], rsi
je 0x1400ab5dc
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [0x140138a20]
mov rcx, qword [rcx + 0x20]
call fcn.140005200
test eax, eax
je 0x1400ab5dc
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x90]
mov r8, qword [0x140138a28]
lea rdx, [0x1400ef254]
lea rcx, [0x1400ef150]
call qword [sym.imp.RPCRT4.dll_NdrClientCall2]
mov qword [rsp + 0x50], rax
mov r8d, dword [rsp + 0x88]
test r8d, r8d
je 0x1400ab5cd
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400ab5cd
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov rcx, qword [0x140138a20]
mov rcx, qword [rcx + 0x20]
call fcn.1400052ec
test eax, eax
je 0x1400ab5bd
mov ebx, esi
mov dword [rsp + 0x40], ebx
mov rdi, qword [rsp + 0x50]
mov eax, dword [rsp + 0x98]
shr eax, 1
cmp ebx, eax
jae 0x1400ab5bd
mov eax, ebx
cmp word [rdi + rax*2], si
je 0x1400ab5bd
movzx edx, word [rdi + rax*2]
lea rcx, [0x140101850]
call fcn.14000b314
inc ebx
mov dword [rsp + 0x40], ebx
jmp 0x1400ab590
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ab5cd
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400ab5dc
xor eax, eax
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400ac43c
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, rcx
mov dword [rbp - 0x30], 0x730025
xor r15d, r15d
mov dword [rbp - 0x2c], 0x270020
lea rcx, str.hid_____s__yKyYMk0rp6va
mov word [rbp - 0xc], r15w
mov rbx, r9
mov dword [rbp - 0x28], 0x730025
mov edi, r8d
mov dword [rbp - 0x24], 0x200027
mov r14, rdx
mov dword [rbp - 0x20], 0x650073
mov dword [rbp - 0x1c], 0x760072
mov dword [rbp - 0x18], 0x630069
mov dword [rbp - 0x14], 0x200065
mov dword [rbp - 0x10], 0x20003a
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140122da0]
lea rcx, str.hid_O___K__wbpM0V6ZwDLj
movdqu xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__B8kemWJusrLZ
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__uIOeAZUyNN9m
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test edi, edi
je 0x1400ac515
mov r8, qword [rbx]
lea rcx, [rbp - 0x30]
mov rdx, r14
call fcn.14000b314
cmp edi, 1
jne 0x1400ac515
mov rcx, qword [rbx]
call rsi
test eax, eax
je 0x1400ac515
lea rcx, [rbp - 0x40]
call fcn.14000b314
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400ad1d4
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
lea rax, str.name
mov edi, ecx
mov qword [r11 - 0x50], rax
lea rcx, str.hid_E___R__wQHxFaUI01jg
lea rax, str.sAMAccountName
xor esi, esi
and qword [r11 - 0x28], rsi
mov r14, r9
mov qword [r11 - 0x48], rax
mov r15d, r8d
lea rax, str.objectSid
mov rbx, rdx
mov qword [r11 - 0x40], rax
lea rax, str.sIDHistory
mov qword [r11 - 0x38], rax
lea rax, str.objectGUID
mov qword [r11 - 0x30], rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__4lhk3ie8yNRU
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__xvPzEyJbYkFu
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, rbx
mov ecx, edi
call fcn.1400ad350
mov rbp, rax
test rax, rax
je 0x1400ad31b
mov rbx, qword [rsp + 0xc0]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], rsi
mov r8, rbx
xor edx, edx
mov rcx, r14
call fcn.14000a4f0
test eax, eax
je 0x1400ad312
mov rdi, qword [rsp + 0xc8]
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
lea r8d, [rsi + 2]
mov qword [rsp + 0x30], rdi
mov r9, rbp
and dword [rsp + 0x28], esi
and qword [rdi], rsi
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WLDAP32.dll_Ordinal_208]
test eax, eax
sete sil
test eax, eax
jne 0x1400ad33c
mov rdx, qword [rdi]
mov rcx, qword [rbx]
call qword [sym.imp.WLDAP32.dll_Ordinal_36]
test eax, eax
je 0x1400ad33a
cmp eax, 1
je 0x1400ad33c
test r15d, r15d
je 0x1400ad33c
xor esi, esi
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400ad2fe
call qword [sym.imp.WLDAP32.dll_Ordinal_41]
mov rcx, qword [rbx]
call qword [sym.imp.WLDAP32.dll_Ordinal_13]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x80]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
xor esi, esi
test esi, esi
je 0x1400ad2f0
mov rdx, qword [rdi]
mov rcx, qword [rbx]
call fcn.1400acf70
jmp 0x1400ad307
Function at 0x1400ad350
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov ebp, ecx
xor ebx, ebx
lea rcx, str.hid_E___R__FjVc9bFPYzg4
mov edi, ebx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__BPBIANaETF5I
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__PabUb5XfXbBT
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
lea r8, [0x140112148]
mov rdx, rsi
mov ecx, ebp
call fcn.14001186c
test eax, eax
je 0x1400ad419
mov rbp, qword [rsp + 0x68]
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rbp + rsi*2], bx
jne 0x1400ad3ba
add rsi, 0x12
mov ecx, 0x40
lea rdx, [rsi + rsi]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400ad4f7
mov r9, rbp
lea r8, str._sAMAccountName_s_
mov rdx, rsi
mov rcx, rax
call fcn.140005514
movsxd rdx, eax
lea rcx, [rsi - 1]
cmp rdx, rcx
je 0x1400ad4f7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, rax
jmp 0x1400ad4f7
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
lea r8, [0x14010b408]
mov rdx, rsi
mov ecx, ebp
call fcn.14001186c
test eax, eax
je 0x1400ad4f7
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x1400ad4f7
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1400ad4ec
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, 0x40
mov r14d, eax
lea esi, [rax + rax*2]
lea rsi, [rsi + 0xd]
lea rdx, [rsi + rsi]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400ad4ec
movups xmm0, xmmword [str._objectSid]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140119e40]
movsd qword [rax + 0x10], xmm1
test r14d, r14d
je 0x1400ad4e2
mov rbp, rbx
mov rax, qword [rsp + 0x60]
lea ecx, [rbx + rbx*2]
lea rcx, [rcx + 0xb]
mov edx, 4
lea rcx, [rdi + rcx*2]
lea r8, str._02x
movzx r9d, byte [rax + rbp]
call fcn.140005514
inc ebx
inc rbp
cmp ebx, r14d
jb 0x1400ad4b2
mov eax, reloc.WLDAP32.dll_Ordinal_41
mov word [rdi + rsi*2 - 4], ax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ae7a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
movdqa xmm0, xmmword [0x1401236f0]
mov ebx, ecx
movdqa xmm1, xmmword [0x140123b50]
lea rcx, str.hid________kB2zy2JIRG4M
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x140123780]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x140122e00]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x140123fd0]
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp - 0x19], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__LK6IdbeZ2hle
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140123770]
lea rcx, str.hid________USPPsUpfx0Vb
movdqa xmm1, xmmword [0x140123920]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x140124040]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmm0, xmmword [0x140122e00]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmm1, xmmword [0x140123250]
movdqa xmmword [rbp + 0x47], xmm0
movdqa xmmword [rbp + 0x37], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140124360]
lea rcx, str.hid_n___o__WnEjcrSreIk6
movdqa xmm1, xmmword [0x140123f70]
and dword [rbp - 0x55], 0
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x59], 0xa
movdqu xmmword [rbp - 0x69], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__DaY6DYDmzRWw
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rbp - 0x49]
call fcn.14000b314
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x77]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400ae8d6
mov rcx, qword [rbp + 0x77]
mov edx, ebx
call fcn.1400aeea0
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 7]
call fcn.14000b314
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 8
lea r9, [rbp + 0x77]
mov rcx, rax
lea r8d, [rdx - 7]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x1400ae916
mov rcx, qword [rbp + 0x77]
mov edx, ebx
call fcn.1400aeea0
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ae92c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x1400ae92c
lea rcx, [rbp - 0x79]
call fcn.14000b314
mov rbx, qword [rsp + 0x100]
xor eax, eax
add rsp, 0xf0
pop rbp
ret
Function at 0x1400b26c0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov eax, r9d
mov qword [rbp - 0x48], rcx
neg eax
mov qword [rbp - 0x50], rdx
lea rax, [rbp - 0x20]
mov r12d, r9d
sbb r14d, r14d
mov qword [rbp - 0x60], rax
lea rax, [0x140138220]
and r14d, 3
lea rcx, str.hid_E___R__F9M1jqyfHYBx
mov qword [rbp - 0x58], rax
inc r14d
mov r15, r8
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__cECEcDzVz1Dd
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r8d, Ordinal_36
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x60]
call fcn.14000a940
test eax, eax
je 0x1400b285f
mov edx, dword [rbp - 0x20]
mov ecx, 0x40
shl rdx, 3
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400b285f
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x50]
mov r8d, dword [rbp - 0x20]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x60]
shl r8, 3
mov qword [rbp - 0x60], rax
call fcn.14000a940
test eax, eax
je 0x1400b2856
xor ebx, ebx
cmp dword [rbp - 0x20], ebx
jbe 0x1400b2856
lea rax, [rbp - 0x40]
mov r8d, Ordinal_36
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rdi + rbx*8]
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x50], rax
call fcn.14000a940
test eax, eax
je 0x1400b284b
mov edx, dword [rbp - 0x40]
mov ecx, 0x40
imul edx, r14d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x1400b284b
mov r8d, dword [rbp - 0x40]
lea rdx, [rbp - 0x50]
mov rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x60]
imul r8d, r14d
mov qword [rbp - 0x50], rax
call fcn.14000a940
test eax, eax
je 0x1400b2841
xor r8d, r8d
cmp dword [rbp - 0x40], r8d
jbe 0x1400b2841
mov rax, qword [rbp - 0x60]
test r12d, r12d
je 0x1400b2829
mov edx, dword [rax + r8*4]
lea rax, str.012345678.F____
mov rcx, qword [r15 + r8*8]
mov al, byte [rdx + rax]
mov byte [rbx + rcx], al
jmp 0x1400b2838
cmp byte [r8 + rax], 0
je 0x1400b2838
mov rax, qword [r15 + r8*8]
mov byte [rbx + rax], SQLGetData
inc r8d
cmp r8d, dword [rbp - 0x40]
jb 0x1400b2809
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc ebx
cmp ebx, dword [rbp - 0x20]
jb 0x1400b2799
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret