joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400066ee
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
lea rdx, [rsp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x48], rbp
call fcn.1400065fe
mov ecx, dword [0x1400a81a4]
xor edx, edx
mov rsi, rax
call fcn.1400065fe
mov rbx, qword [0x1400a81b8]
mov rdi, rax
cmp dword [rbx], ebp
je 0x140006764
mov rcx, qword [rsp + 0x48]
mov r8d, ebp
cmp word [rcx], bp
je 0x140006742
inc r8d
cmp word [rcx + r8*2], bp
jne 0x140006738
cmp r8b, byte [rbx]
je 0x140006751
cmp r8b, byte [rbx + 1]
jne 0x14000685b
call fcn.14000668e
cmp eax, dword [rbx + 4]
je 0x140006764
cmp eax, dword [rbx + 8]
jne 0x14000685b
mov edx, dword [0x1400a81d8]
xor ecx, ecx
mov dword [rsp + 0x40], ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x1400a81dc]
mov r9d, ebp
test ecx, ecx
je 0x1400067a9
mov rcx, qword [str.VirtualProtect]
movsxd r8, r9d
mov edx, dword [rcx + r8]
mov dword [r8 + rax], edx
mov ecx, dword [0x1400a81c8]
add r9d, ecx
mov ecx, dword [0x1400a81dc]
cmp r9d, ecx
jb 0x140006783
mov rdx, rax
mov rcx, rdi
call fcn.14000656e
mov rdi, rax
test rax, rax
je 0x14000685b
mov rbx, qword [0x1400a81ec]
lea r9, [rsp + 0x40]
mov edx, dword [0x1400a81fc]
mov rcx, rbx
mov r8d, dword [0x1400a81dc]
call rdi
mov r9, qword [0x1400a81c0]
mov r8d, 8
mov eax, dword [0x1400a81fc]
mov r9d, r9d
add r9, rsi
mov r10d, dword [r9 + 4]
cmp eax, r8d
jbe 0x140006821
movsxd rdx, r8d
mov ecx, dword [rdx + r9]
add ecx, r10d
mov dword [rdx + rbx], ecx
mov eax, dword [0x1400a81c8]
add r8d, eax
mov eax, dword [0x1400a81fc]
cmp r8d, eax
jb 0x140006800
mov eax, dword [0x1400a81cc]
lea r9, [rsp + 0x40]
mov dword [rbx + 8], eax
mov rcx, rbx
mov edx, dword [0x1400a81fc]
mov r8d, dword [rsp + 0x40]
call rdi
mov eax, dword [0x1400a81b4]
mov r8d, dword [rbx + 0xc]
mov ecx, dword [0x1400a81b4]
add r8, rax
add r8, rbx
add rcx, rbx
call r8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140010e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140010eb3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140010ef7
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140010ef2
cmp rbx, r11
jae 0x140010ef7
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140010ee0
cmp rbx, r11
jb 0x140010efb
xor eax, eax
jmp 0x140010f07
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140012060
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400120be
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400120be
mov dword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x60]
mov rcx, rax
call rdi
test eax, eax
je 0x1400120be
cmp dword [rsp + 0x60], 0
jne 0x14001214f
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
test rbx, rbx
je 0x140012101
lea rdx, str.GetNativeSystemInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140012101
lea rcx, [rsp + 0x20]
call rax
jmp 0x14001210c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x20]
mov ecx, 6
cmp cx, ax
je 0x14001214f
mov ecx, 9
cmp cx, ax
je 0x14001214f
mov ecx, 7
cmp cx, ax
je 0x14001214f
mov ecx, 0xa
cmp cx, ax
je 0x14001214f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x68]
mov eax, 1
add rsp, 0x50
pop rdi
ret
Function at 0x140012170
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
movzx r12d, cl
xor sil, sil
call fcn.140040a20
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x1400121aa
mov ecx, 0x80004005
call fcn.1400118e0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
lea rdx, str.SoftwareMicrosoftNet_Framework_SetupNDP_v4Client
or rbx, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1400121f3
movzx ebp, dx
mov ecx, ebp
call fcn.140040f78
test rax, rax
je 0x140012214
mov r8d, ebp
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140010f20
mov rdi, qword [rsp + 0x40]
jmp 0x140012214
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.140011690
mov rdi, qword [rsp + 0x40]
mov ebp, 1
mov eax, 0x101
test r12b, r12b
cmovne ebp, eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, ebp
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400123b9
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Install
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x1400122be
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Install
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x88], 1
sete sil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x1400123b9
xor sil, sil
xor eax, eax
mov rcx, rbx
lea rdi, str.SoftwareMicrosoftNet_Framework_SetupNDP_v4Full
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SoftwareMicrosoftNet_Framework_SetupNDP_v4Full
lea rcx, [rsp + 0x40]
call fcn.140011690
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, ebp
xor r8d, r8d
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400123b9
mov dword [rsp + 0x90], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Install
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x1400123a1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Install
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x90], 1
sete sil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1400123d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, sil
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001c4d0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x1400a6fa0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rsi, rcx
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x30]
xor edi, edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp dword [rsi - 0x18], edi
jne 0x14001c660
test ebp, ebp
je 0x14001c61a
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x14001c556
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c65e
add eax, 0x8d
mov ecx, eax
mov ebp, eax
call fcn.1400409cc
mov rbx, rax
test rax, rax
jne 0x14001c579
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14001c609
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.140051b60
mov eax, dword [rsi + 8]
lea rdx, [rbx + 0x8c]
mov dword [rbx + 4], eax
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebp, ebp
jne 0x14001c5c4
mov ecx, 0x65b
test eax, eax
cmove eax, ecx
mov edi, eax
mov eax, dword [rbx + 4]
mov r8, qword [rsi + 8]
lea rdx, str.freeker__in_pipe_RecvThread__after_ReadFile__hPipe_d__err_d__pParamRecv__dwSourceID_d_n
lea rcx, [rsp + 0xd0]
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.1400016a0
test ebp, ebp
je 0x14001c609
cmp dword [rsp + 0x34], 0
je 0x14001c609
mov dword [rbx], edi
mov eax, dword [rsp + 0x34]
lea rcx, [rsi - 0x28]
mov rdx, rbx
mov dword [rbx + 0x88], eax
call fcn.14001c6d0
test rbx, rbx
je 0x14001c616
mov rcx, rbx
call fcn.140040a10
mov eax, edi
jmp 0x14001c660
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, SysAllocStringByteLen
call fcn.140051b60
mov r8d, dword [rsi + 8]
lea rdx, str.freeker__before_recv_CloseCallBack__hPipe_d__dwError_d
lea rcx, [rsp + 0xd0]
mov r9d, ebx
mov dword [rsp + 0x4c], r8d
mov dword [rsp + 0x40], ebx
call fcn.1400016a0
lea rcx, [rsi - 0x28]
lea rdx, [rsp + 0x40]
call fcn.14001c7d0
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.14004e770
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001c870
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400a6fa0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r12d, r8d
mov r14, rdx
mov r13, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x34], r15d
cmp qword [rcx + 0x30], 0xffffffffffffffff
jne 0x14001c8ca
mov eax, 0x12664465
jmp 0x14001c99b
mov rcx, r12
call fcn.1400409cc
mov rdi, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x30], eax
test rdi, rdi
je 0x14001c981
mov r8, r12
mov rdx, r14
mov rcx, rdi
call fcn.14004f7f0
mov r9d, r12d
mov r8, qword [r13 + 0x30]
lea rdx, str.freeker__CNamedPipe::SendData__before_WriteFile__hPipe_d__dwDataSizeToSend_d_n
lea rcx, [rsp + 0x50]
call fcn.1400016a0
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
mov r8d, r12d
mov rdx, rdi
mov rcx, qword [r13 + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, r15d
cmp eax, 1
sete sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x30], eax
test esi, esi
je 0x14001c969
mov r9d, eax
mov r8d, esi
lea rdx, str.freeker__CNamedPipe::SendData__succ__after_WriteFile__bRet_d__dwError_d_n
lea rcx, [rsp + 0x50]
call fcn.1400016a0
mov ebx, r15d
mov dword [rsp + 0x30], ebx
jmp 0x14001c981
mov r9d, eax
xor r8d, r8d
lea rdx, str.freeker__CNamedPipe::SendData_err__after_WriteFile__bRet_d__dwError_d_n
lea rcx, [rsp + 0x50]
call fcn.1400016a0
nop
jmp 0x14001c98c
test rdi, rdi
je 0x14001c999
mov rcx, rdi
call fcn.140040a10
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14004e770
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001cee0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebx, 0x1388
xor ebp, ebp
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001cf43
cmp rcx, 0xffffffffffffffff
je 0x14001cf43
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], ebp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x48], 0x103
jne 0x14001cf35
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 0x1f4
test ebx, ebx
jg 0x14001cef6
jmp 0x14001cf43
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rbp
test ebx, ebx
jns 0x14001cfb4
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001cfb4
cmp rcx, 0xffffffffffffffff
je 0x14001cfb4
mov edx, 4
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x14001cfb4
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], ebp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x40], 0x103
jne 0x14001cfa6
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x40], 0x103
je 0x14001cf82
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rbp
lea rbx, [rdi + 0x10]
mov esi, 2
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001cfd7
cmp rcx, 0xffffffffffffffff
je 0x14001cfd7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
add rbx, 8
sub rsi, 1
jne 0x14001cfc0
mov rbx, qword [rsp + 0x50]
mov qword [rdi + 0x58], rbp
mov qword [rdi + 0x60], rbp
mov qword [rdi + 0x68], rbp
mov dword [rdi + 0x24], 1
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001d170
Capabilities:
Create thread

Disassembly:
jmp method.CFREventThread.virtual_8
push rsi
sub rsp, 0x260
mov rax, qword [0x1400a6fa0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, qword [rcx + 8]
mov rsi, rcx
test rax, rax
je 0x14001d1a4
cmp rax, 0xffffffffffffffff
je 0x14001d1a4
xor eax, eax
jmp 0x14001d27d
mov qword [rsp + 0x278], rbx
mov dword [rcx + 0x24], edx
mov qword [rsp + 0x280], rdi
test edx, edx
je 0x14001d20c
xor ebx, ebx
lea rdi, [rcx + 0x10]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x14001d1ee
cmp rax, 0xffffffffffffffff
je 0x14001d1ee
inc ebx
add rdi, 8
cmp ebx, 2
jb 0x14001d1c1
jmp 0x14001d213
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CFREventThread::Run._CreateEvent_err__d_
lea rcx, [rsp + 0x40]
mov r8d, eax
mov ebx, eax
call fcn.1400016a0
jmp 0x14001d254
mov dword [rcx + 0x28], 1
lea rax, [rsp + 0x30]
lea r8, [0x14001d010]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14001d24c
cmp rax, 0xffffffffffffffff
je 0x14001d24c
xor eax, eax
jmp 0x14001d26d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x14001d26b
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
mov r11, qword [rsi]
mov rcx, rsi
call qword [r11 + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x278]
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14004e770
add rsp, 0x260
pop rsi
ret
Function at 0x14001d410
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
cmp qword [rcx + 8], 0
je 0x14001d545
xor r12d, r12d
mov r13d, r12d
nop dword [rax]
cmp r13d, dword [rdi + 0x20]
jae 0x14001d53a
mov ebx, 0x1388
nop
test ebx, ebx
jle 0x14001d4b3
mov esi, r13d
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + rsi*8]
test rax, rax
je 0x14001d450
cmp rax, 0xffffffffffffffff
je 0x14001d450
mov dword [rsp + 0x68], r12d
lea rdx, [rsp + 0x68]
mov rcx, qword [rcx + rsi*8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x68], 0x103
je 0x14001d4a0
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx + rsi*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rdi + 8]
mov qword [r11 + rsi*8], r12
jmp 0x14001d4b3
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 0x1f4
jmp 0x14001d450
test ebx, ebx
jns 0x14001d532
mov ebx, r13d
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + rbx*8]
test rax, rax
je 0x14001d532
cmp rax, 0xffffffffffffffff
je 0x14001d532
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x14001d532
mov dword [rsp + 0x70], r12d
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x70]
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x70], 0x103
je 0x14001d525
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rdi + 8]
mov qword [r11 + rbx*8], r12
jmp 0x14001d532
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001d4f0
inc r13d
jmp 0x14001d440
mov rcx, qword [rdi + 8]
call fcn.140040a10
jmp 0x14001d548
xor r12d, r12d
jmp 0x14001d552
mov qword [rdi + 0x18], r12
mov dword [rdi + 0x20], r12d
mov qword [rdi + 8], r12
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001d600
Capabilities:
Create thread

Disassembly:
jmp method.CFRThread.virtual_8
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
mov rax, qword [rcx + 8]
xor esi, esi
mov rbx, rcx
test rax, rax
je 0x14001d659
mov ecx, esi
cmp dword [rbx + 0x20], ecx
jbe 0x14001d646
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x14001d646
cmp rdx, 0xffffffffffffffff
je 0x14001d646
inc ecx
add rax, 8
cmp ecx, dword [rbx + 0x20]
jb 0x14001d620
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x18]
mov ecx, dword [rbx + 0x20]
mov eax, 8
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rdi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400409cc
mov qword [rbx + 8], rax
test rax, rax
jne 0x14001d694
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001d6ea
mov dword [rbx + 0x10], esi
mov edi, esi
cmp dword [rbx + 0x20], esi
jbe 0x14001d701
mov rbp, rsi
lea rax, [rsp + 0x40]
lea r8, [0x14001d570]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 8]
mov qword [rcx + rbp], rax
mov rax, qword [rbx + 8]
cmp qword [rax + rbp], rsi
je 0x14001d6e2
inc edi
add rbp, 8
cmp edi, dword [rbx + 0x20]
jb 0x14001d6a1
jmp 0x14001d701
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x14001d701
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x18]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
mov eax, esi
add rsp, 0x30
pop rsi
ret
Function at 0x1400245c0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x278], 0xfffffffffffffffe
mov rax, qword [0x1400a6fa0]
xor rax, rsp
mov qword [rsp + 0x298], rax
mov rcx, qword [rsp + 0x2b0]
add rcx, 0x58
call fcn.14002b430
movzx eax, al
test eax, eax
je 0x1400247bc
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x2b0]
add rcx, 0x18
call fcn.140008c70
lea r8, [rsp + 0x20]
lea rdx, str.Version__d
mov rcx, rax
call fcn.140050968
cmp dword [rsp + 0x20], 0xe
jge 0x140024659
mov rcx, qword [rsp + 0x2b0]
add rcx, 0x18
call fcn.140011780
test eax, eax
jne 0x1400247bc
mov dword [rsp + 0x24], 0x104
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x2b8]
call fcn.140011780
test eax, eax
jne 0x140024699
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x1400246b8
mov rcx, qword [rsp + 0x2b8]
call fcn.140008c70
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14004f708
lea rdx, [0x14007cc4c]
lea rcx, [rsp + 0x250]
call fcn.140010db0
nop
lea rcx, [rsp + 0x240]
call fcn.140008c60
nop
xor eax, eax
mov word [rsp + 0x248], ax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x30]
lea rdx, str.New_ManagementRoleAssignment__Name:EaseUs__s__Role:ApplicationImpersonation__User:___s_
lea rcx, [rsp + 0x250]
call fcn.14000fed0
mov rcx, qword [rsp + 0x2b0]
add rcx, 0x58
call fcn.14003b9b0
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x250]
call fcn.140008c70
mov rdx, rax
lea rcx, [rsp + 0x258]
call fcn.1400111c0
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x290], rax
lea rcx, [rsp + 0x240]
call fcn.140013730
mov rdi, rax
mov rcx, qword [rsp + 0x290]
call fcn.140008c70
mov rdx, rax
mov rax, qword [rsp + 0x280]
mov rax, qword [rax]
lea r9, [rsp + 0x248]
mov r8, rdi
mov rcx, qword [rsp + 0x280]
call qword [rax + 0x40]
nop
lea rcx, [rsp + 0x258]
call fcn.140011200
nop
lea rcx, [rsp + 0x240]
call fcn.140011200
nop
lea rcx, [rsp + 0x250]
call fcn.140011910
mov rcx, qword [rsp + 0x298]
xor rcx, rsp
call fcn.14004e770
add rsp, 0x2a0
pop rdi
ret
Function at 0x140040440
Capabilities:
Clear file content
Get file size
Write file on windows

Disassembly:
push rbx
push rsi
sub rsp, 0x68
mov rbx, rcx
mov rcx, qword [rcx]
mov rsi, rdx
cmp rcx, 0xffffffffffffffff
je 0x1400405b8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x88], rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor ebp, ebp
cmp qword [rsp + 0x30], 0x500000
mov rdx, rbp
mov qword [rsp + 0x98], rdx
jle 0x1400404aa
mov rcx, qword [rbx]
lea r8, [rsp + 0x98]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rbx]
lea r8, [rsp + 0x98]
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp qword [rsp + 0x30], rbp
jne 0x140040500
mov rcx, qword [rbx]
mov eax, 0xfeff
lea r9, [rsp + 0x90]
lea rdx, [rsp + 0x80]
mov r8d, 2
mov word [rsp + 0x80], ax
mov dword [rsp + 0x90], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbx]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
lea edx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x7fffffff
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_LockFileEx]
test eax, eax
je 0x1400405b0
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x60], rdi
xor eax, eax
mov rdi, rsi
lea r9, [rsp + 0x80]
mov rdx, rsi
repne scasw ax, word [rdi]
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x20], rbp
not rcx
lea r8d, [rcx + rcx]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbx]
xor edx, edx
lea rax, [rsp + 0x38]
mov r9d, 0x7fffffff
or r8d, 0xffffffff
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rdx
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x88]
add rsp, 0x68
pop rsi
pop rbx
ret