joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005690
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
lea rdx, [0x14001e030]
mov r14, rcx
mov edi, 1
xor ebx, ebx
xor ebp, ebp
call fcn.1400104a0
mov rsi, rax
test rax, rax
jne 0x1400056e6
cmp dword [0x14002f818], 4
jg 0x1400056dd
mov r8, r14
lea rdx, str.could_not_open_file___s__for_reading:__m
lea ecx, [rdi + 3]
call fcn.14000dcf0
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x40], r12
mov rcx, rsi
mov qword [rsp + 0x48], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
cmp eax, 0xffffffff
je 0x140005720
nop
inc ebx
cmp eax, 0xa
jne 0x140005712
inc ebp
cmp ebx, edi
cmovle ebx, edi
mov edi, ebx
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
cmp eax, 0xffffffff
jne 0x140005700
lea eax, [rbp + 1]
test ebx, ebx
cmove eax, ebp
movsxd r15, eax
lea rcx, [r15*8 + 8]
call fcn.14000cc90
cmp ebx, edi
mov r14, rax
cmovle ebx, edi
lea r12d, [rbx + 1]
movsxd rcx, r12d
call fcn.14000cc90
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov r8, rsi
mov edx, r12d
mov rcx, rdi
xor ebp, ebp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x14000579a
xor ebx, ebx
cmp rbx, r15
jge 0x14000579a
mov rcx, rdi
call fcn.14000cc00
mov qword [r14 + rbx*8], rax
mov r8, rsi
mov edx, r12d
mov rcx, rdi
inc rbx
inc ebp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x140005770
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
movsxd rax, ebp
mov rbp, qword [rsp + 0x58]
mov qword [r14 + rax*8], 0
mov rax, r14
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140007ba0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
lea rdx, [0x14001e064]
call fcn.1400104a0
mov rdi, rax
test rax, rax
jne 0x140007bdb
cmp dword [0x14002f818], 4
jg 0x140007c33
lea rdx, str.could_not_open_file___s__for_writing:__m
jmp 0x140007c26
mov rax, qword [rbx]
test rax, rax
je 0x140007c09
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
test eax, eax
js 0x140007c16
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x140007be3
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
je 0x140007c3f
cmp dword [0x14002f818], 4
jg 0x140007c33
lea rdx, str.could_not_write_file___s_:__m
mov r8, rsi
mov ecx, 4
call fcn.14000dcf0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000adf0
Capabilities:
Terminate process

Disassembly:
push rbx
push r14
sub rsp, 0x28
mov qword [rsp + 0x40], rbp
xor ebx, ebx
mov r14, rdx
mov qword [rsp + 0x50], rdi
mov rdi, rcx
mov qword [rsp + 0x20], r15
mov bpl, 1
cmp byte [rdx], bl
je 0x14000ae49
lea rdx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789__._:
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strspn]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r14 + rcx], bl
jne 0x14000ae30
cmp rax, rcx
jne 0x14000ae49
mov bpl, 1
mov r15, r14
jmp 0x14000af19
lea r15, [0x1400213f4]
mov qword [rsp + 0x48], rsi
mov rdx, r15
mov rcx, rdi
call sub.LIBPQ.dll_Ordinal_75
movzx eax, byte [r14]
mov rsi, r14
test al, al
je 0x14000af14
nop
cmp al, 0xa
je 0x14000aeea
cmp al, 0xd
je 0x14000aeea
cmp al, 0x22
jne 0x14000aea5
test ebx, ebx
je 0x14000ae94
lea rdx, [0x1400213f8]
mov rcx, rdi
call sub.LIBPQ.dll_Ordinal_75
sub ebx, 1
jne 0x14000ae80
lea rdx, [0x1400213f8]
mov rcx, rdi
call sub.LIBPQ.dll_Ordinal_75
jmp 0x14000aeaf
cmp al, 0x5c
jne 0x14000aead
inc ebx
jmp 0x14000aeaf
xor ebx, ebx
movzx eax, byte [rsi]
cmp al, 0x61
jl 0x14000aebd
movzx edx, al
cmp al, 0x7a
jle 0x14000aee0
cmp al, 0x41
jl 0x14000aec8
movzx edx, al
cmp al, 0x5a
jle 0x14000aee0
cmp al, 0x30
jl 0x14000aed3
movzx edx, al
cmp al, 0x39
jle 0x14000aee0
mov dl, 0x5e
mov rcx, rdi
call sub.LIBPQ.dll_Ordinal_68
movzx edx, byte [rsi]
mov rcx, rdi
call sub.LIBPQ.dll_Ordinal_68
jmp 0x14000aeed
xor bpl, bpl
movzx eax, byte [rsi + 1]
inc rsi
test al, al
jne 0x14000ae70
test ebx, ebx
je 0x14000af14
lea rdx, [0x1400213f8]
mov rcx, rdi
call sub.LIBPQ.dll_Ordinal_75
sub ebx, 1
jne 0x14000af00
mov rsi, qword [rsp + 0x48]
mov rdx, r15
mov rcx, rdi
call sub.LIBPQ.dll_Ordinal_75
mov r15, qword [rsp + 0x20]
test bpl, bpl
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
jne 0x14000af6c
lea rcx, str.shell_command_argument_contains_a_newline_or_carriage_return:___s__n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, r14
mov rdx, rbx
mov rcx, rax
call fcn.14000ecc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
pop r14
pop rbx
ret
Function at 0x14000bff0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc40
mov rax, qword [0x1400284a0]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, rbx
lea rdx, str.postgres_12
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000c036
lea rdx, [0x140018768]
xor ecx, ecx
call fcn.140010cc0
lea rdx, [rsp + 0x830]
mov rcx, rdi
call fcn.14000c160
test eax, eax
js 0x14000c134
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140011c60
lea rdx, [rsp + 0x430]
mov rcx, rbx
call sub.libintl_8.dll_libintl_bindtextdomain
mov rcx, rbx
call sub.libintl_8.dll_libintl_textdomain
lea rcx, str.PGLOCALEDIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14000c0cd
lea r9, [rsp + 0x430]
mov edx, 0x40e
lea r8, str.PGLOCALEDIR_s
lea rcx, [rsp + 0x20]
call fcn.14000ea30
lea rcx, [rsp + 0x2c]
call fcn.140011270
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
je 0x14000c0cd
mov rcx, rax
call fcn.140010e60
lea rcx, str.PGSYSCONFDIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14000c134
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140011b40
lea r9, [rsp + 0x430]
mov edx, 0x40e
lea r8, str.PGSYSCONFDIR_s
lea rcx, [rsp + 0x20]
call fcn.14000ea30
lea rcx, [rsp + 0x2d]
call fcn.140011270
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
je 0x14000c134
mov rcx, rax
call fcn.140010e60
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.140014dd0
mov rbx, qword [rsp + 0xc60]
add rsp, 0xc40
pop rdi
ret
Function at 0x14000ca60
Capabilities:
Delete directory

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x478
mov rax, qword [0x1400284a0]
xor rax, rsp
mov qword [rsp + 0x460], rax
movzx ebp, dl
mov rsi, rcx
mov bl, 1
call fcn.14000e7c0
mov r14, rax
test rax, rax
je 0x14000cbd9
mov rax, qword [rax]
mov qword [rsp + 0x4a8], rdi
mov rdi, r14
test rax, rax
je 0x14000cb95
mov qword [rsp + 0x4b0], r12
mov r12d, 0x4000
mov qword [rsp + 0x470], r15
mov r15d, 0xf000
nop dword [rax + rax]
mov r9, rsi
mov qword [rsp + 0x20], rax
lea r8, str._s__s
mov edx, 0x400
lea rcx, [rsp + 0x60]
call fcn.14000ea30
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140010af0
test eax, eax
je 0x14000cb1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
je 0x14000cb74
cmp dword [0x14002f818], 3
jg 0x14000cb72
lea rdx, str.could_not_stat_file_or_directory___s_:__m
jmp 0x14000cb63
movzx eax, word [rsp + 0x36]
lea rcx, [rsp + 0x60]
and ax, r15w
cmp ax, r12w
jne 0x14000cb3f
mov dl, 1
call fcn.14000ca60
test al, al
jne 0x14000cb74
jmp 0x14000cb72
call fcn.140010c40
test eax, eax
je 0x14000cb74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
je 0x14000cb74
cmp dword [0x14002f818], 3
jg 0x14000cb72
lea rdx, str.could_not_remove_file_or_directory___s_:__m
lea r8, [rsp + 0x60]
mov ecx, 3
call fcn.14000dcf0
xor bl, bl
mov rax, qword [rdi + 8]
add rdi, 8
test rax, rax
jne 0x14000cad0
mov r15, qword [rsp + 0x470]
mov r12, qword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x4a8]
test bpl, bpl
je 0x14000cbce
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir]
test eax, eax
je 0x14000cbce
cmp dword [0x14002f818], 3
jg 0x14000cbcc
mov r8, rsi
lea rdx, str.could_not_remove_file_or_directory___s_:__m
mov ecx, 3
call fcn.14000dcf0
xor bl, bl
mov rcx, r14
call fcn.14000e960
movzx eax, bl
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140014dd0
add rsp, 0x478
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x14000cc00
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x14000cc3c
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.14000ecc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
jne 0x14000cc78
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.14000ecc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x20
pop rbx
ret
Function at 0x14000cc90
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x14000ce90
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
mov edi, 1
mov esi, edx
cmovne rdi, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14000cf03
test sil, 2
jne 0x14000cef1
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
lea ecx, [rbx + 2]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rdi
call fcn.14000ecc0
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test sil, 4
je 0x14000cf5d
movzx eax, dil
or al, bl
test al, 3
jne 0x14000cf50
cmp rdi, 0x400
ja 0x14000cf50
xor edx, edx
lea rcx, [rdi + 3]
shr rcx, 2
lea rax, [rdi + rbx]
cmp rbx, rax
cmova rcx, rdx
test rcx, rcx
je 0x14000cf5d
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000cd50
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x14000cd8c
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.14000ecc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
jne 0x14000cdc8
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.14000ecc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x14000ce10
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x20
mov edi, 1
test rcx, rcx
jne 0x14000ce27
test rdx, rdx
cmove rdx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
jne 0x14000ce69
lea rcx, str.out_of_memory_n
mov qword [rsp + 0x30], rbx
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.14000ecc0
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000ce90
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x14000ce90
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
mov edi, 1
mov esi, edx
cmovne rdi, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14000cf03
test sil, 2
jne 0x14000cef1
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
lea ecx, [rbx + 2]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rdi
call fcn.14000ecc0
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test sil, 4
je 0x14000cf5d
movzx eax, dil
or al, bl
test al, 3
jne 0x14000cf50
cmp rdi, 0x400
ja 0x14000cf50
xor edx, edx
lea rcx, [rdi + 3]
shr rcx, 2
lea rax, [rdi + rbx]
cmp rbx, rax
cmova rcx, rdx
test rcx, rcx
je 0x14000cf5d
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000cf70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, Ordinal_130
mov ecx, edi
mov r14d, dword [rax]
call fcn.14000cde0
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea r9, [rsp + 0x78]
mov edx, edi
mov rcx, rsi
mov dword [rax], r14d
mov rbp, qword [rsp + 0x70]
mov r8, rbp
call fcn.14000e9a0
test eax, eax
js 0x14000d028
nop dword [rax]
movsxd rcx, eax
cmp rcx, rdi
jb 0x14000cfe5
cmp eax, 0x3ffffffe
ja 0x14000d074
inc eax
movsxd rbx, eax
cmp rbx, rdi
jb 0x14000d064
mov rcx, rsi
call fcn.14000ce80
mov rcx, rbx
call fcn.14000cde0
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea r9, [rsp + 0x78]
mov rdx, rbx
mov rcx, rsi
mov dword [rax], r14d
mov rbp, qword [rsp + 0x70]
mov r8, rbp
call fcn.14000e9a0
mov rdi, rbx
test eax, eax
jns 0x14000cfd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call fcn.1400123d0
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbp
lea rdx, str.vsnprintf_failed:__s_with_format_string___s__n
mov rcx, rax
mov r8, rbx
call fcn.14000ecc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rsi
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.14000ecc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000e060
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
sub rsp, 0x48
lea rcx, str.PG_RESTRICT_EXEC
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [0x14002f810], rax
test rax, rax
je 0x14000e094
movzx ecx, byte [rax]
cmp cl, byte [0x140021b9c]
jne 0x14000e094
movzx eax, byte [rax + 1]
cmp al, byte [0x140021b9d]
je 0x14000e101
xor eax, eax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call fcn.14000cc00
lea rcx, str.PG_RESTRICT_EXEC1
mov rbx, rax
call fcn.140010e60
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000e180
mov rbx, qword [rsp + 0x40]
test rax, rax
jne 0x14000e106
cmp dword [0x14002f818], 4
jg 0x14000e101
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.could_not_re_execute_with_restricted_token:_error_code__lu
mov ecx, 4
mov r8d, eax
call fcn.14000dcf0
add rsp, 0x48
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x20]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14000e16d
cmp dword [0x14002f818], 4
jg 0x14000e161
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.could_not_get_exit_code_from_subprocess:_error_code__lu
mov ecx, 4
mov r8d, eax
call fcn.14000dcf0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000e500
Capabilities:
Get session user name
Terminate process

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x101
lea rcx, [0x14002ef90]
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x14000e57d
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.user_name_lookup_failure:_error_code__lu
mov ebx, eax
call sub.libintl_8.dll_libintl_gettext
mov rcx, rax
mov edx, ebx
call fcn.14000cf70
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea rdx, str._s:__s_n
mov rcx, rax
mov r8, rdi
call fcn.14000ecc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rbx, qword [rsp + 0x30]
lea rax, [0x14002ef90]
add rsp, 0x20
pop rdi
ret

Function at 0x14000eb90
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x1400284a0]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x14000ebd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140014dd0
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
call fcn.14000ef70
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x14000ec75
test rdi, rdi
je 0x14000ec75
mov r9, qword [rsp + 0x38]
mov r8, rdi
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, dword [rsp + 0x40]
add ecx, eax
movzx ebx, bl
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x14000ec79
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
test bl, bl
mov rbx, qword [rsp + 0x470]
mov eax, 0xffffffff
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140014dd0
add rsp, 0x478
ret
Function at 0x14000f6c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14d, ecx
cmp edx, 1
jne 0x14000f729
mov rax, qword [r8 + 0x10]
test rax, rax
je 0x14000f70f
cmp qword [r8], rax
jb 0x14000f70f
cmp qword [r8 + 0x18], 0
jne 0x14000f707
inc dword [r8 + 0x20]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, rbx
call fcn.14000fc10
mov rax, qword [rbx]
mov byte [rax], r14b
inc qword [rbx]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edx, edx
jle 0x14000f7c1
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000f74d
sub eax, dword [rbx]
jmp 0x14000f74f
mov eax, ebp
test eax, eax
jg 0x14000f791
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000f7b4
cmp byte [rbx + 0x24], 0
mov rcx, qword [rbx + 8]
jne 0x14000f788
mov rdi, qword [rbx]
sub rdi, rcx
je 0x14000f788
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000f788
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x14000f7ae
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
mov edx, r14d
cmovl esi, eax
movsxd rdi, esi
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
add qword [rbx], rdi
sub ebp, esi
test ebp, ebp
jg 0x14000f740
jmp 0x14000f7b7
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000f7e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14, rcx
cmp edx, 1
jne 0x14000f839
mov rax, qword [r8 + 0x10]
movzx edi, byte [rcx]
test rax, rax
je 0x14000f82b
cmp qword [r8], rax
jb 0x14000f82b
cmp qword [r8 + 0x18], 0
jne 0x14000f823
inc dword [r8 + 0x20]
jmp 0x14000f8c5
mov rcx, rbx
call fcn.14000fc10
mov rax, qword [rbx]
mov byte [rax], dil
inc qword [rbx]
jmp 0x14000f8c5
test edx, edx
jle 0x14000f8c5
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000f853
sub eax, dword [rbx]
jmp 0x14000f855
mov eax, ebp
test eax, eax
jg 0x14000f897
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000f8bd
cmp byte [rbx + 0x24], 0
mov rcx, qword [rbx + 8]
jne 0x14000f88e
mov rdi, qword [rbx]
sub rdi, rcx
je 0x14000f88e
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000f88e
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x14000f8b7
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
mov rdx, r14
cmovl esi, eax
movsxd rdi, esi
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x14000f846
jmp 0x14000f8c0
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000fc10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp byte [rbx + 0x24], 0
jne 0x14000fc6e
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx]
sub rdi, rcx
je 0x14000fc60
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x14000fc55
mov byte [rbx + 0x24], 1
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret