joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bc40
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, r8
mov dword [r11 - 0x48], r9d
xor edi, edi
mov qword [r11 - 0x40], rdi
lea r9, [r11 - 0x40]
mov r8, qword [rsp + 0xa0]
call fcn.14000c230
test al, al
jne 0x14000bc8c
xor bl, bl
jmp 0x14000bd33
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400109c0
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [0x1400900c8]
mov ecx, eax
call fcn.14000c380
movzx ebx, al
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000bd20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bd1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd61
call fcn.140028ef4
movdqa xmm0, xmmword [0x140055c40]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000bd43
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140028f90
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
call fcn.140033494
nop
int3
Function at 0x14000be80
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [r11 - 0x70], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [r11 - 0x78], r14
or r8, 0x10009
lea r9, [r11 - 0x78]
call fcn.14000c230
test al, al
je 0x14000bf42
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rdx, [0x1400900d0]
mov ecx, eax
call fcn.14000c380
test al, al
je 0x14000bf42
movdqa xmm0, xmmword [0x140057e40]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140057e30]
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], 0xffffffff80000003
lea rax, [rsp + 0x50]
nop word [rax + rax]
mov rbx, qword [rax]
cmp rdi, rbx
je 0x14000bf7c
add rax, 8
lea rcx, [rsp + 0x78]
cmp rax, rcx
jne 0x14000bf20
lea rcx, str.Invalid_key.
call fcn.14000e970
xor bl, bl
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000bf54
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140028f90
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400109c0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea rdx, [0x1400900d0]
mov ecx, eax
call fcn.14000c380
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000bff9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bff4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c012
call fcn.140028ef4
movdqa xmm0, xmmword [0x140055c40]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
jmp 0x14000bf44
call fcn.140033494
int3

Function at 0x14000c8c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rbx + 0x18], 8
jb 0x14000c8db
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000c8ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x20
pop rbx
ret
test al, 0x10
je 0x14000c8f7
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14000c980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rbx + 0x18], 8
jb 0x14000c9a2
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000c9c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
shr ecx, 4
and cl, 1
cmp ebx, 0xffffffff
mov byte [rdi], cl
mov rbx, qword [rsp + 0x30]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x14000c9f0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14000ca12
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14000ca3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test dil, 1
je 0x14000cad5
xor ecx, ecx
and edi, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14000ca5c
mov rcx, qword [rbx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14000cabc
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rbx + 0x18], 8
mov r9, rbx
jb 0x14000ca85
mov r9, qword [rbx]
mov r8d, edi
lea rcx, str.Failed_to_set_file_attributes:__d__0x_x__for__ls
mov edx, edi
call fcn.14000e970
cmp qword [rbx + 0x18], 8
jb 0x14000caa0
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.Failed_to_make_writable:__ls
call fcn.14000e970
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x18], 8
jb 0x14000cac6
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.Made_writable:__ls
call fcn.14000e970
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14000d380
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000d3b6
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000d3d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000d3d9
test al, 0x10
jne 0x14000d484
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000d3ee
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000d484
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000d415
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000d484
cmp qword [rbx + 0x18], 8
jb 0x14000d41f
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400104f0
nop
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rdx, qword [rsp + 0x28]
lea rcx, str.Unable_to_create_directory:__s
call fcn.14000e970
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000d484
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d47f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d499
call fcn.140028ef4
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x50
pop rbx
ret
call fcn.140033494
int3
add rcx, 8
jmp 0x14000d380
Function at 0x14000d4b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000d3b6
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000d3d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000d3d9
test al, 0x10
jne 0x14000d484
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000d3ee
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000d484
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000d415
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000d484
cmp qword [rbx + 0x18], 8
jb 0x14000d41f
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400104f0
nop
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rdx, qword [rsp + 0x28]
lea rcx, str.Unable_to_create_directory:__s
call fcn.14000e970
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000d484
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d47f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d499
call fcn.140028ef4
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x50
pop rbx
ret
call fcn.140033494
int3
add rcx, 8
jmp 0x14000d380
Function at 0x140019420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dl, 1
xor ecx, ecx
call fcn.14000e9c0
cmp qword [rbx + 0x18], 8
jb 0x14001943c
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dl, 1
xor ecx, ecx
mov ebx, eax
call fcn.14000e9c0
cmp ebx, 0xffffffff
je 0x140019462
test bl, 0x10
jne 0x140019462
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140019e50
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dl, 1
xor ecx, ecx
call fcn.14000e9c0
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140019e73
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dl, 1
xor ecx, ecx
mov edi, eax
call fcn.14000e9c0
cmp edi, 0xffffffff
je 0x140019eb3
test dil, 0x10
jne 0x140019eb3
cmp qword [rbx + 0x18], 8
jb 0x140019e99
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
sete al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140019f90
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x40
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov rsi, rdx
mov qword [rdx + 8], rax
mov rbx, rcx
mov qword [rdx], rax
cmp qword [rcx + 0x18], 8
jb 0x140019fc0
mov rcx, qword [rcx]
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x14001a059
mov rcx, rbp
mov qword [rsp + 0x70], rdi
call fcn.1400290c0
cmp qword [rbx + 0x18], 8
mov rdi, rax
jb 0x140019feb
mov rbx, qword [rbx]
mov r9, rdi
mov r8d, ebp
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14001a04a
lea r9, [rsp + 0x28]
mov rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [0x140059b10]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x14001a04a
mov rax, qword [rsp + 0x20]
movzx ecx, word [rax + 8]
movzx r8d, word [rax + 0xc]
movzx edx, word [rax + 0xe]
movzx eax, word [rax + 0xa]
mov dword [rsi + 4], ecx
mov rcx, rdi
mov dword [rsi], eax
mov dword [rsi + 8], edx
mov dword [rsi + 0xc], r8d
call fcn.140028ef4
mov al, 1
jmp 0x14001a054
mov rcx, rdi
call fcn.140028ef4
xor al, al
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001ba76
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
call fcn.14000e9c0
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140019513
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dl, 1
xor ecx, ecx
mov edi, eax
call fcn.14000e9c0
cmp edi, 0xffffffff
je 0x14001952f
test dil, 0x10
jne 0x140019556
mov dl, 1
xor ecx, ecx
call fcn.14000e9c0
cmp qword [rbx + 0x18], 8
jb 0x140019542
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dl, 1
xor ecx, ecx
call fcn.14000e9c0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1401f5055
jmp 0x140019501
Function at 0x14001cc90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001cd41
cmp byte [rcx + 0x72], 0
je 0x14001cd41
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14001cd03
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14001cd07
sub eax, 1
je 0x14001cd0b
sub eax, 2
je 0x14001cd41
xor al, al
jmp 0x14001cd43
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001cd38
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14003d890
cmp rdi, rax
jne 0x14001cd03
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14001cd43
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140028f90
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x14001e280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001e2ad
xor eax, eax
jmp 0x14001e3f3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14001e2e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14001e2e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14001e3f3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001e3e6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001e32a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001e339
movsx ecx, dil
jmp 0x14001e38d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x14001e3e6
cmp eax, 1
jle 0x14001e3a7
cmp eax, 3
jne 0x14001e3e6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14003cf2c
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001e3eb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001e3d4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14003d890
cmp rsi, rax
jne 0x14001e3e6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14001e3eb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140028f90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001e420
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x14001e45b
xor eax, eax
cmp dx, si
cmove di, ax
movzx eax, di
jmp 0x14001e5a8
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14001e497
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14001e497
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, di
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14001e5a8
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14001e59d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001e4de
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001e507
movzx ecx, di
mov rdx, qword [rbx + 0x80]
call fcn.14003c534
cmp ax, si
je 0x14001e59d
movzx esi, di
jmp 0x14001e59d
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], di
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x14001e59d
cmp eax, 1
jle 0x14001e55d
cmp eax, 3
jne 0x14001e59d
movzx ecx, word [rsp + 0x50]
jmp 0x14001e4ea
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14001e58a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.14003d890
cmp rbp, rax
jne 0x14001e59d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, di
jne 0x14001e5a0
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x140021ca0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r14d, r14d
mov rbp, rdx
mov r15, rcx
mov esi, r14d
mov edi, r14d
cmp dword [rcx + 8], r14d
jbe 0x140021d2b
mov qword [rsp + 0x40], rbx
nop dword [rax]
mov eax, edi
lea rbx, [rax + rax*2]
shl rbx, 4
add rbx, qword [r15]
cmp dword [rbx + 0x1c], 0
jne 0x140021d1e
cmp dword [rbp + 0x1c], 0
jne 0x140021d1e
mov eax, dword [rbp + 0x20]
cmp dword [rbx + 0x20], eax
jne 0x140021d1e
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140021d1e
mov rdx, qword [rbp + 0x28]
test rdx, rdx
je 0x140021d1e
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x140021d1e
mov eax, dword [rbx + 4]
dec eax
cmp eax, 1
jbe 0x140021d1b
or esi, dword [rbx]
jmp 0x140021d1e
or r14d, dword [rbx]
inc edi
cmp edi, dword [r15 + 8]
jb 0x140021cd0
mov rbx, qword [rsp + 0x40]
not esi
and esi, r14d
cmp dword [rbp], esi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
sete al
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140022760
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rdx, [0x1400a0410]
lea rcx, [rsp + 0x58]
call fcn.1400200c0
nop
cmp byte [0x140090200], 0
jne 0x1400227ad
lea rcx, str.Cant_write__not_connected.
call fcn.14000e970
jmp 0x140022848
mov dword [rsp + 0x40], 0
lea rax, [0x1400a0350]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, dword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, qword [0x14008d4b0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140022848
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140022841
mov dl, 1
lea rbx, str.Error_writing_to_pipe.
mov rcx, rbx
call fcn.14000e9c0
mov rcx, qword [0x140090208]
test rcx, rcx
je 0x14002283a
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], 6
mov rcx, qword [rcx + 0xf8]
test rcx, rcx
je 0x140022865
mov rax, qword [rcx]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
call fcn.140022da0
jmp 0x140022848
mov byte [0x1400a03e1], 1
lea rcx, [rsp + 0x58]
call fcn.1400200f0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x70
pop rbx
ret
call fcn.1400273a4
nop
int3

Function at 0x140022cd5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
test rax, rax
jne 0x1400019ab
jmp 0x140025cd0
mov eax, dword [rbp + 0x24]
and eax, 0xffffff80
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
test eax, 0x80
je 0x14002542d
jmp 0x140006191
mov eax, 1
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
mov dword [rbp + 0x38], eax
mov eax, dword [rbp + 0x38]
test eax, eax
jne 0x140001c1d
jmp 0x140006ac0
mov eax, 1
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
xor eax, eax
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x70], rcx
mov dword [rbp + 0x78], edx
mov eax, dword [rbp + 0x78]
test eax, eax
jne 0x1400251fb
jmp 0x140053dea
mov rax, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rdx, qword [rbp + 0x70]
lea rcx, [rbp]
mov qword [rbp + 0x48], rcx
mov rcx, rdx
mov rdx, qword [rbp + 0x48]
mov r8d, 0x30
call rax
jmp 0x140001311
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rbp + 0x70]
mov ecx, dword [rbp + 0x78]
mov ecx, ecx
mov ebx, dword [rbp + 0x24]
or ebx, 0x40
lea rsi, [rbp + 0x24]
mov qword [rbp + 0x30], rcx
mov rcx, rdx
mov rdx, qword [rbp + 0x30]
mov r8d, ebx
mov r9, rsi
call rax
jmp 0x140005475
xor eax, eax
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
xor eax, eax
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret