joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180030024
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180030054
xor eax, eax
jmp 0x180030117
mov rbp, rbx
cmp word [rax], si
je 0x180030079
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180030060
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18003005c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18002e92c
movsxd r14, eax
test eax, eax
jne 0x1800300b7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18003004d
mov rcx, r14
call fcn.180028a20
mov rdi, rax
test rax, rax
jne 0x1800300d0
xor ecx, ecx
call fcn.1800289e4
jmp 0x1800300ac
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18002e92c
test eax, eax
jne 0x180030101
mov rcx, rdi
call fcn.1800289e4
jmp 0x18003010b
xor ecx, ecx
call fcn.1800289e4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180032e8c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180025d18
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180032f2d
cmp ebx, dword [rsp + 0x30]
je 0x180032f26
test esi, esi
je 0x180032f26
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180032f01
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180032f0e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180032eeb
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180032f12
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180032f2f
mov eax, 1
jmp 0x180032f2f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180037770
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800258b8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800258b8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800378c0
cmp rax, 0xffffffffffffffff
je 0x1800378c0
xor edi, edi
test rbp, rbp
jle 0x18003786b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18002896c
mov rbx, rax
test rax, rax
jne 0x1800377f8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180037861
mov edx, 0x8000
mov ecx, r14d
call fcn.1800375f4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18002bdac
cmp eax, 0xffffffff
je 0x180037841
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180037808
mov edx, r15d
mov ecx, r14d
call fcn.1800375f4
jmp 0x180037861
cmp byte [rsi + 0x38], dil
je 0x180037858
cmp dword [rsi + 0x34], 5
jne 0x180037858
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180037861
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800289e4
jmp 0x1800378d4
jns 0x1800378d4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800258b8
cmp rax, 0xffffffffffffffff
jne 0x18003788c
cmp byte [rsi + 0x30], dil
je 0x1800378d4
mov edi, dword [rsi + 0x2c]
jmp 0x1800378d4
mov ecx, r14d
call fcn.1800307e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800378d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800378d4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800378cd
mov eax, dword [rsi + 0x2c]
jmp 0x1800378d2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800258b8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180038250
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180038278
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180038278
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000b0c0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x14000b100
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x14000b260
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000b2bb
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14000b2c4
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14000b2ab
mov qword [rsi], rdi
call fcn.140054e70
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.14006a280
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140054e70
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.14006a2c0
mov rcx, qword [rsi]
call fcn.14006a250
mov qword [rsi], 0
jmp 0x14000b286
Function at 0x14000e850
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
mov rdi, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
cmp rdi, rax
jne 0x14000ea00
mov r15, qword [r13]
mov rbx, qword [r13 + 8]
mov rcx, rbx
sub rcx, r15
jbe 0x14000e8d7
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
add rax, 1
sar rax, 1
mov rsi, rax
neg rsi
shl rax, 3
mov r15, rbx
sub r15, rax
sub rdi, rbx
je 0x14000e8c3
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.1401836f0
mov rbx, qword [r13 + 8]
add rdi, r15
mov qword [r13 + 0x10], rdi
lea rax, [rbx + rsi*8]
mov qword [r13 + 8], rax
jmp 0x14000ea00
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov esi, 1
cmovne rsi, rcx
mov rax, rsi
shr rax, 0x3d
jne 0x14000ea1b
mov r12, rsi
shr r12, 2
lea rcx, [rsi*8]
call fcn.140180340
lea r11, [rax + r12*8]
mov r9, r11
lea r8, [rax + rsi*8]
sub rdi, rbx
je 0x14000e9da
lea r10, [rdi - 8]
mov ecx, r10d
shr ecx, 3
inc ecx
and rcx, 7
je 0x14000e952
neg rcx
mov rdx, r9
mov rsi, qword [rbx]
mov qword [rdx], rsi
add rdx, 8
add rbx, 8
inc rcx
jne 0x14000e93a
mov rcx, rdx
jmp 0x14000e958
mov rdx, r9
mov rcx, r9
add r11, rdi
cmp r10, 0x38
jb 0x14000e9d6
sar rdi, 3
shl r12, 3
lea rsi, [r12 + rdi*8]
sub rsi, rdx
mov r15, rax
add r15, rsi
lea r10, [rdx + 0x40]
xor esi, esi
mov rdi, qword [rbx + rsi]
mov qword [rcx], rdi
mov rcx, qword [rbx + rsi + 8]
mov qword [rdx + rsi + 8], rcx
mov rcx, qword [rbx + rsi + 0x10]
mov qword [rdx + rsi + 0x10], rcx
mov rcx, qword [rbx + rsi + 0x18]
mov qword [rdx + rsi + 0x18], rcx
mov rcx, qword [rbx + rsi + 0x20]
mov qword [rdx + rsi + 0x20], rcx
mov rcx, qword [rbx + rsi + 0x28]
mov qword [rdx + rsi + 0x28], rcx
mov rcx, qword [rbx + rsi + 0x30]
mov qword [rdx + rsi + 0x30], rcx
mov rcx, qword [rbx + rsi + 0x38]
mov qword [rdx + rsi + 0x38], rcx
lea rcx, [r10 + rsi]
add rsi, 0x40
cmp r15, rsi
jne 0x14000e97c
mov r15, qword [r13]
mov qword [r13], rax
mov qword [r13 + 8], r9
mov qword [r13 + 0x10], r11
mov qword [r13 + 0x18], r8
test r15, r15
je 0x14000e9fd
mov rcx, r15
call fcn.140180390
mov rdi, qword [r13 + 0x10]
jmp 0x14000ea00
mov rdi, r11
mov rax, qword [r14]
mov qword [rdi], rax
add qword [r13 + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140194834
int3
Function at 0x14000ea30
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov r14, rcx
mov rcx, qword [rcx]
mov rbx, qword [r14 + 8]
cmp rbx, rcx
je 0x14000ea5a
mov r12, rbx
jmp 0x14000ebe0
mov r15, qword [r14 + 0x10]
mov rax, qword [r14 + 0x18]
cmp r15, rax
jae 0x14000eab0
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea rsi, [rax + rcx]
add rsi, 1
sar rsi, 1
lea r12, [r15 + rsi*8]
mov r8, r15
sub r8, rbx
je 0x14000ea9f
sub r12, r8
mov rcx, r12
mov rdx, rbx
call fcn.1401836f0
mov r15, qword [r14 + 0x10]
mov qword [r14 + 8], r12
lea rax, [r15 + rsi*8]
mov qword [r14 + 0x10], rax
jmp 0x14000ebe0
sub rax, rcx
mov rcx, rax
sar rcx, 2
test rax, rax
mov esi, 1
cmovne rsi, rcx
mov rax, rsi
shr rax, 0x3d
jne 0x14000ebfe
lea r13, [rsi + 3]
shr r13, 2
lea rcx, [rsi*8]
call fcn.140180340
lea r10, [rax + r13*8]
mov r12, r10
lea r8, [rax + rsi*8]
sub r15, rbx
je 0x14000ebc0
lea r9, [r15 - 8]
mov edx, r9d
shr edx, 3
inc edx
mov r11, rdi
and rdx, 7
je 0x14000eb2f
neg rdx
mov rdi, r12
mov rcx, qword [rbx]
mov qword [rdi], rcx
add rdi, 8
add rbx, 8
inc rdx
jne 0x14000eb17
mov rdx, rdi
jmp 0x14000eb35
mov rdi, r12
mov rdx, r12
add r10, r15
cmp r9, 0x38
jb 0x14000ebba
sar r15, 3
shl r13, 3
lea rbp, [r15*8]
add rbp, r13
sub rbp, rdi
mov rcx, rax
add rcx, rbp
lea r9, [rdi + 0x40]
xor ebp, ebp
mov rsi, qword [rbx + rbp]
mov qword [rdx], rsi
mov rdx, qword [rbx + rbp + 8]
mov qword [rdi + rbp + 8], rdx
mov rdx, qword [rbx + rbp + 0x10]
mov qword [rdi + rbp + 0x10], rdx
mov rdx, qword [rbx + rbp + 0x18]
mov qword [rdi + rbp + 0x18], rdx
mov rdx, qword [rbx + rbp + 0x20]
mov qword [rdi + rbp + 0x20], rdx
mov rdx, qword [rbx + rbp + 0x28]
mov qword [rdi + rbp + 0x28], rdx
mov rdx, qword [rbx + rbp + 0x30]
mov qword [rdi + rbp + 0x30], rdx
mov rdx, qword [rbx + rbp + 0x38]
mov qword [rdi + rbp + 0x38], rdx
lea rdx, [r9 + rbp]
add rbp, 0x40
cmp rcx, rbp
jne 0x14000eb60
mov rbx, qword [r14]
mov rdi, r11
mov qword [r14], rax
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r10
mov qword [r14 + 0x18], r8
test rbx, rbx
je 0x14000ebe0
mov rcx, rbx
call fcn.140180390
mov r12, qword [r14 + 8]
mov rax, qword [rdi]
mov qword [r12 - 8], rax
add qword [r14 + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140194834
int3
Function at 0x1400127a0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0x20
call fcn.140193bd4
mov edi, 6
cmp eax, 0x20
jne 0x140012864
mov ecx, dword [rsi + 8]
mov rdi, qword [sym.imp.WS2_32.dll_ntohl]
call rdi
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rdi
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rdi
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rdi
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rdi
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rdi
mov dword [rsi + 0x1c], eax
lea rdx, [rsp + 0x28]
mov ecx, ebx
call fcn.14019141c
mov edi, 6
test eax, eax
jne 0x140012864
movabs rax, 0x303146464944424d
mov edi, 8
cmp qword [rsi], rax
jne 0x140012864
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x140012864
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x140012864
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x140012864
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x140012864
setne al
movzx edi, al
shl edi, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140012880
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov r12, r8
mov ebx, edx
mov rdi, rcx
mov r13d, dword [rcx + 8]
mov ebp, dword [rcx + 0x18]
add ebp, dword [rcx + 0x14]
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.14006b640
test rax, rax
je 0x1400128e4
mov r14, rax
add r13, r12
mov rsi, rax
test ebp, ebp
je 0x1400128eb
mov ecx, ebx
mov rdx, rsi
mov r8d, ebp
call fcn.140193bd4
test eax, eax
js 0x140012906
sub ebp, eax
mov ecx, eax
add rsi, rcx
test eax, eax
jne 0x1400128be
test ebp, ebp
je 0x1400128be
jmp 0x1400128ff
mov ebx, 1
jmp 0x140012913
mov eax, dword [rdi + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x140012926
mov ebx, 8
jmp 0x14001290b
mov ebx, 6
mov rcx, r14
call fcn.14006b690
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test eax, eax
je 0x140012a63
mov dword [rsp + 0x24], r15d
mov rbp, r14
add rbp, rax
mov eax, dword [rdi + 0x18]
add rax, rbp
mov ecx, dword [rdi + 0x1c]
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r12
mov r15, r12
mov qword [rsp + 0x40], rax
mov rdi, rax
mov qword [rsp + 0x28], rbp
mov r12, r14
mov ecx, dword [r12]
mov rsi, qword [sym.imp.WS2_32.dll_ntohl]
call rsi
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r13
sub rcx, r15
cmp rcx, rax
jb 0x1400128ff
mov rcx, qword [rsp + 0x40]
sub rcx, rbp
cmp rcx, rax
jb 0x1400128ff
test eax, eax
je 0x1400129cb
xor eax, eax
mov cl, byte [r15 + rax]
add byte [rbp + rax], cl
inc rax
mov r8d, dword [r12]
cmp rax, r8
jb 0x1400129b5
jmp 0x1400129ce
xor r8d, r8d
mov ecx, dword [rsp + 0x24]
mov rdx, rbp
call fcn.140197d54
mov ebx, 7
cmp eax, dword [r12]
jne 0x14001290b
mov esi, eax
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rdi
cmp rax, r8
jb 0x1400128ff
mov ecx, dword [rsp + 0x24]
mov rdx, rdi
call fcn.140197d54
cmp eax, dword [r12 + 4]
jne 0x14001290b
mov edx, esi
add r15, rdx
movsxd rcx, dword [r12 + 8]
mov rbx, qword [rsp + 0x30]
sub rbx, r15
cmp rbx, rcx
jg 0x1400128ff
mov rbx, r13
sub rbx, r15
cmp rbx, rcx
jl 0x1400128ff
add rbp, rdx
mov eax, eax
add rdi, rax
add r15, rcx
add r12, 0xc
xor ebx, ebx
cmp r12, qword [rsp + 0x28]
jb 0x140012962
jmp 0x14001290b
xor ebx, ebx
jmp 0x14001290b
Function at 0x140012a70
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r15, r8
mov rbp, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor esi, esi
mov rcx, rdx
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.1401931bc
cmp eax, 1
sbb esi, esi
not esi
or esi, dword [rbx]
js 0x140012af5
lea rdx, [rsp + 0x70]
mov ecx, esi
call fcn.1400127a0
mov r12d, 0xffffffff
xor r14d, r14d
test eax, eax
je 0x140012aff
mov edi, eax
mov ebx, 0xffffffff
jmp 0x140012c1e
mov edi, 6
jmp 0x140012c45
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov rcx, rbp
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.1401931bc
mov ebx, dword [rsp + 0x38]
cmp eax, 1
mov ebp, 0
sbb ebp, ebp
not ebp
or ebp, ebx
js 0x140012c06
lea rdx, [rsp + 0x38]
mov ecx, ebp
call fcn.14019141c
mov r12d, 0xffffffff
mov edi, 6
test eax, eax
jne 0x140012c1b
mov r13d, dword [rsp + 0x4c]
cmp r13d, dword [rsp + 0x78]
jne 0x140012c0f
mov rcx, r13
call fcn.14006b640
test rax, rax
je 0x140012c16
mov r14, rax
mov ecx, ebp
mov rdx, rax
mov r8d, r13d
call fcn.140193bd4
cmp eax, dword [rsp + 0x78]
jne 0x140012c1e
mov ebp, eax
call fcn.14008dea0
movsxd rdx, ebp
mov rcx, r14
call fcn.14008de70
not eax
cmp dword [rsp + 0x7c], eax
jne 0x140012c6b
lea r12, [rsp + 0x6c]
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r15
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
call fcn.1401931bc
mov r12d, dword [r12]
cmp eax, 1
sbb ebp, ebp
not ebp
or ebp, r12d
js 0x140012c72
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
mov r9d, ebp
call fcn.140012880
mov edi, eax
jmp 0x140012c1e
mov edi, 6
mov ebx, ebp
jmp 0x140012c1e
mov edi, 8
jmp 0x140012c1b
mov edi, 1
xor r14d, r14d
mov rcx, r14
call fcn.14006b690
mov ecx, esi
call fcn.14018e8b0
test ebx, ebx
js 0x140012c38
mov ecx, ebx
call fcn.14018e8b0
test r12d, r12d
js 0x140012c45
mov ecx, r12d
call fcn.14018e8b0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x140012c1e
mov r12d, ebp
jmp 0x140012c1e

Function at 0x140017b00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14019b3f8
cmp rax, rbx
jne 0x140017b87
cmp edi, 1
je 0x140017b34
cmp edi, 2
je 0x140017b87
mov rcx, qword [rsi + 0x40]
call fcn.14019a398
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140180700
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140017bb0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140017be5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14019b3f8
xor ebx, ebx
test rsi, rsi
jle 0x140017c0a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x140017c0a
inc rbx
cmp rsi, rbx
jne 0x140017bec
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140017c20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x140017c7d
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x140017c8c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14019b3f8
mov esi, 0xffffffff
cmp rax, 1
jne 0x140017d3c
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x140017d3c
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140017d37
mov ebp, eax
cmp eax, 3
je 0x140017d16
cmp ebp, 1
ja 0x140017d37
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14019b3f8
cmp rax, rsi
jne 0x140017d37
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140017ca9
jmp 0x140017c7d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14019b3f8
cmp rax, 1
je 0x140017c7d
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140180700
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140017da0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140017dd5
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14019b3f8
xor ebx, ebx
test rsi, rsi
jle 0x140017dfb
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x140017dfb
inc rbx
cmp rsi, rbx
jne 0x140017ddc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140017e10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x140017e6c
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x140017e7c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14019b3f8
mov di, 0xffff
cmp rax, 1
jne 0x140017f2b
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x140017f2b
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x140017f27
mov ebp, eax
cmp eax, 3
je 0x140017f06
cmp ebp, 1
ja 0x140017f27
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14019b3f8
cmp rax, rbx
jne 0x140017f27
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x140017e99
jmp 0x140017e6c
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.14019b3f8
cmp rax, 1
je 0x140017e6c
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400484a0
Capabilities:
Get session information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x140048553
lea r9, [rsp + 0x40]
mov qword [r9], 0
lea rcx, [rsp + 0x3c]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140048553
mov rbx, qword [rsp + 0x40]
mov ecx, 0x30
call fcn.140180340
mov rdi, rax
lea rdx, [0x140049220]
lea r8, [0x14000ac30]
mov rcx, rax
call fcn.14004bea0
lea rax, [0x1401b5730]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rbx
lea rdx, [rsp + 0x28]
mov qword [rdx], rdi
lea rcx, [rsp + 0x30]
call fcn.140099500
cmp dword [rsp + 0x3c], 0xd7
ja 0x14004855c
mov qword [rsi], 0
jmp 0x140048570
mov qword [rsi], 0
jmp 0x14004857a
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0xc8]
mov rcx, rsi
call fcn.1400998e0
lea rcx, [rsp + 0x30]
call fcn.140099530
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140180700
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret