joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180027000
Capabilities:
Resume thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov ebx, edx
mov r12, rcx
call fcn.180057520
cmp qword [0x180094840], 0
je 0x180027066
lea rcx, [rsp + 0x28]
call fcn.18001d660
nop
mov rax, qword [r12]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, r12
call qword [rax + 0xd0]
mov ebp, eax
test eax, eax
jne 0x18002706a
lea rcx, [rsp + 0x28]
call fcn.18001d670
xor eax, eax
jmp 0x1800270d9
xor edi, edi
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x1800270cd
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + rsi*4]
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x180094840]
mov rbx, rax
test rsi, rsi
jne 0x1800270a1
test rax, rax
je 0x1800270c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
inc rsi
cmp edi, dword [rsp + 0x30]
jge 0x1800270cd
jmp 0x180027080
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12 + 8], eax
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.18001d670
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x180027100
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov ebx, r9d
mov r13, r8
mov rbp, rdx
mov r12, rcx
lea rcx, [rsp + 0x28]
call fcn.18001d660
nop
mov rax, qword [r12]
mov r8d, ebx
lea rdx, [rsp + 0x28]
mov rcx, r12
call qword [rax + 0xb0]
test eax, eax
jne 0x180027163
lea rcx, [rsp + 0x28]
call fcn.18001d670
xor eax, eax
jmp 0x1800271ff
xor esi, esi
mov ebx, esi
cmp dword [rsp + 0x30], ebx
jle 0x1800271f0
mov edi, esi
test esi, esi
jne 0x180027194
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea r8d, [rsi + 1]
lea rdx, str.SeDebugPrivilege
call fcn.18005b440
mov esi, 1
mov rax, qword [rsp + 0x28]
mov r9, qword [r12]
mov r8d, dword [rdi + rax]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [r9 + 0x80]
nop
mov r8, r13
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call fcn.180026e80
test eax, eax
je 0x1800271da
mov rax, qword [rsp + 0x28]
mov r8d, dword [rdi + rax]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18001d8e0
nop
lea rcx, [rsp + 0x60]
call fcn.180014ec0
inc ebx
add rdi, 4
cmp ebx, dword [rsp + 0x30]
jl 0x180027173
lea rcx, [rsp + 0x28]
call fcn.18001d670
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x180028760
Capabilities:
Get common file path
Get file version info

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov eax, dword [0x18009319c]
test eax, eax
jne 0x180028888
mov byte [rsp + 0x150], al
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x151]
call fcn.18002a9c0
mov edx, 0x104
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x180028882
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.18002a9c0
lea r9, str.user32.dll
lea r8, [rsp + 0x150]
lea rdx, str._s_s
lea rcx, [rsp + 0x40]
call fcn.18002c00c
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x24], eax
mov ecx, eax
call fcn.18002ae9c
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180028882
mov r9, rax
mov r8d, dword [rsp + 0x24]
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x18002887a
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x28]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x18002887a
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax]
mov dword [0x18009319c], ecx
jmp 0x18002887a
mov rcx, rbx
call fcn.18002af40
mov eax, dword [0x18009319c]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x270
pop rbx
ret

Function at 0x180028e70
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [0x1800931a0], 0
jne 0x180028f8f
lea rcx, [0x180093020]
mov edi, 1
mov dword [0x180093020], 0x94
mov dword [0x1800931a0], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor r11d, r11d
cmp dword [0x180093030], 2
sete r11b
mov dword [0x18008c66c], r11d
test r11d, r11d
je 0x180028f6f
lea rcx, [0x1800930c0]
mov qword [rsp + 0x30], rbx
mov dword [0x1800930c0], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProductInfo
mov rcx, rbx
mov qword [0x180093018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x30]
mov qword [0x180093190], rax
mov rax, qword [0x180093018]
lea rcx, [0x180093160]
test rax, rax
je 0x180028f39
call rax
jmp 0x180028f3f
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1800930c4]
cmp eax, 6
jae 0x180028f58
cmp eax, 5
jne 0x180028f6f
cmp dword [0x1800930c8], 2
jb 0x180028f6f
mov ecx, dword [0x180093010]
cmp word [0x180093160], 9
cmove ecx, edi
mov dword [0x180093010], ecx
lea rdx, [0x180093028]
lea rcx, [0x180093024]
call fcn.180028d30
call fcn.180028ac0
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180034457
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18008cb00]
jne 0x18002a9aa
rol rcx, 0x10
test cx, 0xffff
jne 0x18002a9a6
repz ret
ror rcx, 0x10
jmp 0x1800343b0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1800932c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1800933b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180034435
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1800932c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180034457
mov rax, qword [rsp + 0x88]
mov qword [0x1800933b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180093358], rax
mov rax, qword [0x1800933b8]
mov qword [0x180093230], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180093340], rax
mov dword [0x180093220], 0xc0000409
mov dword [0x180093224], 1
mov rax, qword [0x18008cb00]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18008cb08]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800932b8], eax
mov ecx, 1
call fcn.180043f4c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180074dc8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800932b8], 0
jne 0x1800344de
mov ecx, 1
call fcn.180043f4c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18004f358
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180030cc0
xor ebx, ebx
cmp qword [0x180094288], rbx
mov rdi, rax
jne 0x18004f46b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18004f542
lea rdx, [0x180077cc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004f542
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180094288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180094290], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180094298], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1800942a8], rax
test rax, rax
je 0x18004f462
lea rdx, [0x180077c60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1800942a0], rax
jmp 0x18004f472
mov rax, qword [0x1800942a0]
jmp 0x18004f479
mov rax, qword [0x1800942a0]
mov r11, qword [0x1800942a8]
cmp rax, rdi
je 0x18004f4e0
cmp r11, rdi
je 0x18004f4e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1800942a8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18004f4e0
test rax, rax
je 0x18004f4e0
call rsi
test rax, rax
je 0x18004f4da
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18004f4da
test byte [rsp + 0x40], 1
jne 0x18004f4e0
bts ebp, 0x15
jmp 0x18004f520
mov rcx, qword [0x180094290]
cmp rcx, rdi
je 0x18004f520
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18004f520
call rax
mov rbx, rax
test rax, rax
je 0x18004f520
mov rcx, qword [0x180094298]
cmp rcx, rdi
je 0x18004f520
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18004f520
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180094288]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18004f542
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18004f544
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180058660
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
call fcn.180057520
mov r11, qword [0x180094700]
mov rdx, rbx
mov rcx, rdi
test r11, r11
je 0x1800586aa
mov eax, dword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov dword [rsp + 0x20], eax
call r11
jmp 0x1800586b0
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180058e90
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180094b84]
test ecx, ecx
jne 0x180058faf
mov eax, dword [0x180094b80]
cmp eax, 3
ja 0x180058faf
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180094b80], eax
call fcn.180029060
test eax, eax
je 0x180058ed6
lea rcx, str.Userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180058ee3
lea rcx, [0x1800793c8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180058ef5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.CreateEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
mov qword [0x180094b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserA
mov rcx, rbx
mov qword [0x180094b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserW
mov rcx, rbx
mov qword [0x180094b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileA
mov rcx, rbx
mov qword [0x180094b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileW
mov rcx, rbx
mov qword [0x180094b68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnloadUserProfile
mov rcx, rbx
mov qword [0x180094b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x180094b84], 1
mov qword [0x180094b78], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x180058fc0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180094bdc]
test ecx, ecx
jne 0x180059124
mov eax, dword [0x180094bd8]
cmp eax, 3
ja 0x180059124
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180094bd8], eax
call fcn.180029060
test eax, eax
je 0x180059006
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180059013
lea rcx, [0x1800794e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180059025
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, rbx
mov qword [0x180094b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessMemoryInfo
mov rcx, rbx
mov qword [0x180094b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
mov qword [0x180094b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExW
mov rcx, rbx
mov qword [0x180094ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleInformation
mov rcx, rbx
mov qword [0x180094ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x180094bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180094bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameA
mov rcx, rbx
mov qword [0x180094bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameW
mov rcx, rbx
mov qword [0x180094bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x180094bd0], rax
mov dword [0x180094bdc], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x18005a470
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x390
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rdi, rdx
mov r8, rdx
mov edx, 4
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test eax, eax
je 0x18005a5dc
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x3c0], rsi
mov byte [rsp + 0x270], 0
call fcn.18002a9c0
lea rdx, [0x1800798e0]
lea rcx, [rsp + 0x270]
mov r8, rbp
call fcn.18002c00c
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18005a5d2
lea rdx, [0x180070964]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18005a5af
lea rdx, [0x180070960]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18005a5af
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.18002a9c0
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rsp + 0x160]
mov r8, rbp
call fcn.18002c00c
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x160]
je 0x18005a59f
mov rdx, rdi
call fcn.18005a470
jmp 0x18005a5ad
mov r8, rdi
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test ebx, ebx
je 0x18005a5c9
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18005a521
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x3c0]
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x390
pop rdi
pop rbp
pop rbx
ret
Function at 0x18005b4b0
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x40
xor ebx, ebx
lea rax, [rsp + 0x78]
mov rsi, rdx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rdx], rbx
mov rbp, rcx
mov rdx, rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x18005b510
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x18005b510
xor eax, eax
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x60], rdi
call fcn.18002ae9c
mov ecx, dword [rsp + 0x68]
mov qword [rsi], rax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18002ae9c
mov r8, qword [rsi]
mov rdi, rax
test r8, r8
je 0x18005b57b
test rax, rax
je 0x18005b58c
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x70]
mov rdx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test rdi, rdi
je 0x18005b588
mov rcx, rdi
call fcn.18002af40
test ebx, ebx
jne 0x18005b599
mov rcx, qword [rsi]
test rcx, rcx
je 0x18005b599
call fcn.18002af40
mov eax, ebx
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret

Function at 0x18005ca10
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x18005ca74
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005c740
jmp 0x18005ca7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x18005ca8e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18005ca10

Function at 0x18005cb60
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x148
ret
Function at 0x18005cbc0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call fcn.18002a9c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x248
ret

Function at 0x18005cc20
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18005cc9b
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.18002b4f4
test rax, rax
je 0x18005cc87
mov byte [rax], 0
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005c740
jmp 0x18005cca1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x18005ccb5
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret

Function at 0x18005cce0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.18002a9c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18005cd5f
lea edx, [rdi + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.18002b51c
test rax, rax
je 0x18005cd4b
mov word [rax], di
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005c7e0
jmp 0x18005cd65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x18005cd7b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18002a990
mov rbx, qword [rsp + 0x278]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005cdb0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18005ce14
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005c740
jmp 0x18005ce1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x18005ce2e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret

Function at 0x18005ce50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.18002a9c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18005ceba
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005c7e0
jmp 0x18005cec0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x18005ced6
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18002a990
mov rbx, qword [rsp + 0x278]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret

Function at 0x18005cf00
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.180028fe0
test eax, eax
je 0x18005cf3d
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005cdb0
jmp 0x18005cfb4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18005cf93
lea rdx, [0x18006fd00]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.180068950
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005c740
jmp 0x18005cf99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x18005cfad
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18005cf00