joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050e80
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x140050ed9
jmp 0x140050faa
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jne 0x140050ef6
jmp 0x140050faa
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140050f15
jmp 0x140050faa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140050f2f
jmp 0x140050faa
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140050fa0
mov byte [rsp + 0x50], 1
xor eax, eax
test eax, eax
jne 0x140050eaf
cmp qword [rsp + 0x48], 0
je 0x140050fbd
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], 0
je 0x140050fd0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, byte [rsp + 0x50]
add rsp, 0x78
ret

Function at 0x140050fe0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400258a0
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
xor eax, eax
mov word [rsp + 0xb0], ax
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400258a0
lea r11, [rsp + 0x50]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x108]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rsp + 0xe0], eax
cmp dword [rsp + 0xe0], 0
jne 0x1400510af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400804c8]
lea rcx, [0x1400a5fd0]
call fcn.140048c60
xor al, al
jmp 0x1400510d7
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xf8
ret
Function at 0x1400554c0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1a8
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rdx, [0x140078724]
mov rcx, qword [rsp + 0x1b8]
call fcn.140026708
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x138], 0
jne 0x140055545
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str._GetPEver_fp__null__err:0x_x__n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov r11, qword [rsp + 0x1b0]
mov dword [r11 + 0x17c0], 1
xor al, al
jmp 0x140055710
mov dword [rsp + 0x130], 0
mov r9, qword [rsp + 0x138]
mov r8d, 0x40
mov edx, 1
lea rcx, [rsp + 0x150]
call fcn.140027374
mov dword [rsp + 0x130], eax
movsxd rax, dword [rsp + 0x130]
cmp rax, 0x40
jne 0x140055594
movzx eax, word [rsp + 0x150]
cmp eax, 0x5a4d
je 0x1400555cc
movzx r9d, word [rsp + 0x150]
mov r8d, dword [rsp + 0x130]
lea rdx, str._GetPEver_nsize0x_x__magic:0x_x__n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov rcx, qword [rsp + 0x138]
call fcn.140026f24
xor al, al
jmp 0x140055710
xor r8d, r8d
mov edx, dword [rsp + 0x18c]
mov rcx, qword [rsp + 0x138]
call fcn.14002760c
mov r9, qword [rsp + 0x138]
mov r8d, 0x108
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140027374
mov dword [rsp + 0x130], eax
mov rcx, qword [rsp + 0x138]
call fcn.140026f24
movzx r9d, word [rsp + 0x24]
mov r8d, dword [rsp + 0x130]
lea rdx, str._size:0x_x__machine:0x_x__n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
movsxd rax, dword [rsp + 0x130]
cmp rax, 0x108
jne 0x14005564f
cmp dword [rsp + 0x20], 0x4550
je 0x140055656
xor al, al
jmp 0x140055710
movzx eax, word [rsp + 0x24]
cmp eax, 0x14c
jne 0x14005567b
mov rax, qword [rsp + 0x1c0]
mov byte [rax], 0
lea rcx, str.i386_n
call fcn.1400264fc
jmp 0x1400556c3
movzx eax, word [rsp + 0x24]
cmp eax, 0x200
je 0x140055693
movzx eax, word [rsp + 0x24]
cmp eax, 0x8664
jne 0x1400556ac
mov rax, qword [rsp + 0x1c0]
mov byte [rax], 1
lea rcx, str.x64_n
call fcn.1400264fc
jmp 0x1400556c3
mov rax, qword [rsp + 0x1c0]
mov byte [rax], 0
lea rcx, str.Unknow__n_n
call fcn.1400264fc
movzx ecx, word [rsp + 0x64]
mov rax, qword [rsp + 0x1c0]
mov dword [rax + 4], ecx
movzx ecx, word [rsp + 0x66]
mov rax, qword [rsp + 0x1c0]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x1c0]
mov r9d, dword [rax + 8]
mov rax, qword [rsp + 0x1c0]
mov r8d, dword [rax + 4]
lea rdx, str.major:_d__min:_d_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov al, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x1a8
ret
Function at 0x1400558e0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x290
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x288], rax
mov byte [rsp + 0x40], 0
lea rdi, [rsp + 0x41]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov byte [rsp + 0x160], 0
lea rdi, [rsp + 0x161]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x2a8]
add rax, 3
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x2a8]
call fcn.140025720
mov dword [rsp + 0x150], eax
movsxd rcx, dword [rsp + 0x150]
mov rax, qword [rsp + 0x2a8]
lea rax, [rax + rcx - 1]
cmp qword [rsp + 0x30], rax
jae 0x1400559de
mov rax, qword [rsp + 0x30]
movsx eax, byte [rax]
cmp eax, 0x5c
jne 0x1400559ce
mov rcx, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x30]
sub rax, rcx
mov dword [rsp + 0x150], eax
movsxd r8, dword [rsp + 0x150]
mov rdx, qword [rsp + 0x2a8]
lea rcx, [rsp + 0x160]
call fcn.1400261c0
movsxd rdx, dword [rsp + 0x150]
mov byte [rsp + rdx + 0x160], 0
jmp 0x1400559de
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x30], rax
jmp 0x14005595f
movsx eax, byte [rsp + 0x160]
test eax, eax
jne 0x1400559ff
mov rdx, qword [rsp + 0x2a8]
lea rcx, [rsp + 0x160]
call fcn.140026030
lea r8, [rsp + 0x160]
lea rdx, str._sexplorer.exe
lea rcx, [rsp + 0x40]
call fcn.140025b64
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x140055a52
mov r8d, 0x105
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1400258a0
lea r8, [rsp + 0x160]
lea rdx, str._s_regedit.exe
lea rcx, [rsp + 0x40]
call fcn.140025b64
mov r9, qword [rsp + 0x2a8]
lea r8, [rsp + 0x40]
lea rdx, str._detect_file_ver:_s__szpath:_s__n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2a0]
call fcn.1400554c0
movzx eax, al
test eax, eax
je 0x140055b2a
mov rcx, qword [rsp + 0x2b0]
movzx eax, byte [rsp + 0x270]
mov byte [rcx], al
mov rax, qword [rsp + 0x2b8]
mov byte [rax], 0
cmp dword [rsp + 0x274], 0xa
jl 0x140055ac9
mov rax, qword [rsp + 0x2b8]
mov byte [rax], 1
movzx eax, byte [rsp + 0x270]
test eax, eax
je 0x140055ae6
lea rax, [0x140078754]
mov qword [rsp + 0x280], rax
jmp 0x140055af5
lea rax, [0x1400789bc]
mov qword [rsp + 0x280], rax
mov eax, dword [rsp + 0x278]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x274]
mov r8, qword [rsp + 0x280]
lea rdx, str.__s__major:_d__minor:_d__n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
mov eax, 1
jmp 0x140055b2c
xor eax, eax
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x290
pop rdi
ret
Function at 0x140057450
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x410
mov qword [rsp + 0x3f8], 0xfffffffffffffffe
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0x430]
mov byte [rax], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1004
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.14001db4c
nop
mov byte [rsp + 0x2e0], 0
lea rdi, [rsp + 0x2e1]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140057527
lea rcx, [rsp + 0x60]
call fcn.14001d25c
mov rdx, rax
lea rax, [rsp + 0x2e0]
mov qword [rdx + 0x50], rax
lea rcx, [rsp + 0x60]
call fcn.14001e780
cmp rax, 1
je 0x140057555
mov dword [rsp + 0x3f0], 0
lea rcx, [rsp + 0x60]
call fcn.14001d968
mov eax, dword [rsp + 0x3f0]
jmp 0x1400575ba
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.14001e930
nop
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call fcn.140008e80
mov rdx, rax
mov rcx, qword [rsp + 0x430]
call fcn.140026030
mov edx, 0xffffffff
lea rcx, [rsp + 0x50]
call fcn.14000ae40
mov dword [rsp + 0x3f4], 1
lea rcx, [rsp + 0x50]
call fcn.140008e60
nop
lea rcx, [rsp + 0x60]
call fcn.14001d968
mov eax, dword [rsp + 0x3f4]
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x410
pop rdi
ret

Function at 0x140058240
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r9d, 4
lea r8, [0x140080898]
lea rdx, str.Do_you_want_to_close_the_program_and_restart_your_computer_
mov rcx, qword [rsp + 0x40]
call fcn.140011a58
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 6
jne 0x1400582f0
mov rcx, qword [rsp + 0x40]
add rcx, 0x7c0
call fcn.14005ccd0
mov rcx, qword [rsp + 0x40]
add rcx, 0x1140
call fcn.1400532a0
mov rcx, qword [rsp + 0x40]
add rcx, 0x17c8
call fcn.140048700
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x17c0], 0
jne 0x1400582bf
lea rcx, [0x1400a5fd0]
call fcn.140048d50
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.set_CDAudio_door_open
call qword [sym.imp.WINMM.dll_mciSendStringA]
xor edx, edx
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov edx, 1
mov rcx, qword [rsp + 0x40]
call fcn.14000edcc
add rsp, 0x38
ret
Function at 0x14005b5d0
Capabilities:
Check if file exists

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rdi, [rsp + 0x31]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
movsx r8d, byte [rsp + 0x168]
lea rdx, [0x140081888]
lea rcx, [rsp + 0x30]
call fcn.140025b64
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14005b636
mov eax, 1
jmp 0x14005b638
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x150
pop rdi
ret

Function at 0x14005b820
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x280
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x278], rax
movzx eax, byte [0x140073d7b]
mov byte [rsp + 0x140], al
lea rdi, [rsp + 0x141]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
movzx eax, byte [0x140073dca]
mov byte [rsp + 0x30], al
lea rdi, [rsp + 0x31]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x258], rax
cmp qword [rsp + 0x258], 0xffffffffffffffff
jne 0x14005b8a7
mov eax, 0xffffffff
jmp 0x14005ba2c
mov dword [rsp + 0x260], 0
mov dword [rsp + 0x264], 0
lea r9, [rsp + 0x264]
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x14005b8ee
mov eax, dword [rsp + 0x264]
mov byte [rsp + rax + 0x30], 0
cmp dword [rsp + 0x264], 1
ja 0x14005b9f8
mov dword [rsp + 0x26c], 0
mov byte [rsp + 0x268], 0x43
mov byte [rsp + 0x269], 0x3a
mov byte [rsp + 0x26a], 0x5c
mov byte [rsp + 0x26b], 0
lea rcx, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x270], 1
je 0x14005b950
cmp dword [rsp + 0x270], 0
jne 0x14005b95d
mov dword [rsp + 0x26c], 1
jmp 0x14005b97b
movzx eax, byte [rsp + 0x268]
add al, 1
mov byte [rsp + 0x268], al
movsx eax, byte [rsp + 0x268]
cmp eax, 0x5a
jl 0x14005b927
cmp dword [rsp + 0x26c], 0
jne 0x14005b98a
jmp 0x14005ba1c
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
mov dword [rsp + 0x250], eax
cmp dword [rsp + 0x250], 0
je 0x14005b9f8
movzx edx, byte [rsp + 0x268]
mov rcx, qword [rsp + 0x290]
call fcn.14005b690
test eax, eax
jne 0x14005b9e3
movzx edx, byte [rsp + 0x268]
mov rcx, qword [rsp + 0x290]
call fcn.14005b5d0
test eax, eax
jne 0x14005b9f8
lea rcx, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
mov dword [rsp + 0x250], eax
mov r8d, 0x104
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
jne 0x14005b8a7
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor eax, eax
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x280
pop rdi
ret
Function at 0x14005c240
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x14005c299
jmp 0x14005c36a
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jne 0x14005c2b6
jmp 0x14005c36a
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14005c2d5
jmp 0x14005c36a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x14005c2ef
jmp 0x14005c36a
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14005c360
mov byte [rsp + 0x50], 1
xor eax, eax
test eax, eax
jne 0x14005c26f
cmp qword [rsp + 0x48], 0
je 0x14005c37d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], 0
je 0x14005c390
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, byte [rsp + 0x50]
add rsp, 0x78
ret

Function at 0x14005c3a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400258a0
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
xor eax, eax
mov word [rsp + 0xb0], ax
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400258a0
lea r11, [rsp + 0x50]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x108]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rsp + 0xe0], eax
cmp dword [rsp + 0xe0], 0
jne 0x14005c46f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateProcess22_failed__err:0x_x_n
lea rcx, [0x1400a5fd0]
call fcn.140048c60
xor al, al
jmp 0x14005c497
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xf8
ret
Function at 0x14005c4f0
Capabilities:
Check if file exists
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x198], rax
mov byte [rsp + 0x80], 0
lea rdi, [rsp + 0x81]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rcx, [rsp + 0x190]
call fcn.14005c4b0
lea rcx, [rsp + 0x190]
call fcn.14005c4d0
mov qword [rsp + 0x30], rax
lea rax, [0x14007ba7c]
mov qword [rsp + 0x38], rax
lea rax, [0x14007be74]
mov qword [rsp + 0x40], rax
lea rax, [0x14007c144]
mov qword [rsp + 0x48], rax
lea rax, [0x14007c24c]
mov qword [rsp + 0x50], rax
lea rax, [0x14007c26c]
mov qword [rsp + 0x58], rax
lea rax, [0x14007c43c]
mov qword [rsp + 0x60], rax
lea rax, [0x14007c55c]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
movsxd r9, dword [rax + 0x18]
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + r9*8 + 0x38]
mov r8, qword [rsp + 0x1b8]
lea rdx, str._s__s__02d
lea rcx, [rsp + 0x80]
call fcn.140025b64
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x14005c604
mov r8d, 1
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x1a0
pop rdi
ret
Function at 0x140062330
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x13c], 0
mov rax, qword [rsp + 0x160]
cmp dword [rax + 0xc0], 0
jge 0x14006237c
mov eax, 1
jmp 0x1400625cf
mov rax, qword [rsp + 0x160]
movsxd rax, dword [rax + 0xc0]
xor r9d, r9d
lea r8, str.SAMDomainsAccountUsersNames_
xor edx, edx
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004bf50
mov dword [rsp + 0x138], eax
cmp dword [rsp + 0x138], 0
jne 0x1400623df
mov rcx, qword [rsp + 0x160]
add rcx, 0x15d
lea rdx, str.Cant_find_any_user_account_in_your_SAM_database
call fcn.140026030
mov eax, 1
jmp 0x1400625cf
lea rcx, str._RID_____________Username______________Admin____Lock_____n
call fcn.1400264fc
mov edx, dword [rsp + 0x138]
add edx, 4
mov rax, qword [rsp + 0x160]
movsxd r10, dword [rax + 0xc0]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x13c]
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx + r10*8 + 0x60]
call fcn.14004caa0
test eax, eax
jle 0x1400625cd
mov r9, qword [rsp + 0x130]
lea r8, [0x140082dd0]
mov edx, 0xb4
lea rcx, [rsp + 0x50]
call fcn.1400260f4
mov r11, qword [rsp + 0x160]
movsxd rax, dword [r11 + 0xc0]
mov r9d, 0x181
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004e090
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x1f4
jne 0x1400624b4
mov rcx, qword [rsp + 0x160]
add rcx, 0xdc
mov r8d, 0x80
mov rdx, qword [rsp + 0x130]
call fcn.1400261c0
mov r9d, dword [rsp + 0x40]
lea r8, [0x140082df8]
mov edx, 0xb4
lea rcx, [rsp + 0x50]
call fcn.1400260f4
mov r11, qword [rsp + 0x160]
movsxd rax, dword [r11 + 0xc0]
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx + rax*8 + 0x60]
call fcn.14004d710
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14006252d
lea rdx, [rsp + 0x50]
lea rcx, str.Cannot_find_value___s__n
call fcn.1400264fc
jmp 0x1400623eb
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0xcc
jge 0x140062555
mov rax, qword [rsp + 0x38]
mov r8d, dword [rax]
lea rdx, [rsp + 0x50]
lea rcx, str.list_users:_Value___s__is_too_short__only__d_bytes__to_be_a_SAM_user_V_struct__n
call fcn.1400264fc
jmp 0x140062589
mov rdx, qword [rsp + 0x38]
add rdx, 4
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x38]
mov r9d, dword [rax]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x160]
call fcn.1400614c0
cmp qword [rsp + 0x38], 0
je 0x1400625a4
mov rcx, qword [rsp + 0x38]
call fcn.140025614
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x130], 0
je 0x1400625c8
mov rcx, qword [rsp + 0x130]
call fcn.140025614
mov qword [rsp + 0x130], 0
jmp 0x1400623eb
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x158
ret
Function at 0x140063390
Capabilities:
Authenticate hmac

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x218
mov rax, qword [0x1400945f8]
xor rax, rsp
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x220], 0
jne 0x1400633d1
mov eax, 1
jmp 0x1400635f7
mov ecx, dword [rsp + 0x228]
call fcn.14003eb20
mov r11d, eax
mov rax, qword [rsp + 0x220]
mov dword [rax + 8], r11d
mov rax, qword [rsp + 0x220]
mov eax, dword [rax + 8]
mov dword [rsp + 0xf4], eax
mov ecx, dword [rsp + 0x228]
call fcn.14003eac0
mov r11d, eax
mov rax, qword [rsp + 0x220]
mov dword [rax + 4], r11d
mov rax, qword [rsp + 0x220]
mov eax, dword [rax + 4]
mov dword [rsp + 0xf0], eax
mov rcx, qword [rsp + 0x220]
mov eax, dword [rsp + 0x228]
mov dword [rcx], eax
mov eax, dword [rsp + 0xf4]
cmp dword [rsp + 0x238], eax
jle 0x1400634f6
mov edx, dword [rsp + 0x228]
lea rcx, [rsp + 0x100]
call fcn.14003ec70
test eax, eax
jne 0x1400634ac
mov r8d, dword [rsp + 0x238]
mov rdx, qword [rsp + 0x230]
lea rcx, [rsp + 0x100]
call fcn.14003eb80
test eax, eax
jne 0x1400634ac
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x100]
call fcn.14003ed30
test eax, eax
jne 0x1400634ac
mov dword [rsp + 0x1f4], 0
jmp 0x1400634b7
mov dword [rsp + 0x1f4], 1
mov eax, dword [rsp + 0x1f4]
mov dword [rsp + 0x1f0], eax
cmp dword [rsp + 0x1f0], 0
je 0x1400634db
mov eax, dword [rsp + 0x1f0]
jmp 0x1400635f7
lea rax, [rsp + 0x30]
mov qword [rsp + 0x230], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x238], eax
mov dword [rsp + 0x20], 0
jmp 0x14006350b
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x238]
cmp dword [rsp + 0x20], eax
jge 0x14006355f
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x230]
movzx ecx, byte [rax + rcx]
xor ecx, 0x36
movsxd rax, dword [rsp + 0x20]
mov byte [rsp + rax + 0x70], cl
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x230]
movzx edx, byte [rax + rcx]
xor edx, 0x5c
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x220]
mov byte [rax + rcx + 0xf8], dl
jmp 0x140063500
jmp 0x14006356c
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xf4]
cmp dword [rsp + 0x20], eax
jge 0x14006359a
movsxd rax, dword [rsp + 0x20]
mov byte [rsp + rax + 0x70], 0x36
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x220]
mov byte [rax + rcx + 0xf8], 0x5c
jmp 0x140063561
mov rcx, qword [rsp + 0x220]
add rcx, 0x10
mov edx, dword [rsp + 0x228]
call fcn.14003ec70
test eax, eax
jne 0x1400635e5
mov rcx, qword [rsp + 0x220]
add rcx, 0x10
mov r8d, dword [rsp + 0xf4]
lea rdx, [rsp + 0x70]
call fcn.14003eb80
test eax, eax
jne 0x1400635e5
mov dword [rsp + 0x1f8], 0
jmp 0x1400635f0
mov dword [rsp + 0x1f8], 1
mov eax, dword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400252b0
add rsp, 0x218
ret