joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100010390
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x100049390]
cmp ax, 0xcb
je 0x1000104cc
cmp ax, 0xcc
je 0x1000104cc
nop
mov rax, qword [0x10006e4a0]
test rax, rax
je 0x1000103cd
mov ecx, dword [0x10006e290]
call rax
mov rbx, rax
jmp 0x1000103d4
lea rbx, [0x10006e298]
cmp word [0x10006e280], 0
jle 0x1000103fc
lea rcx, [0x10006e250]
call fcn.1000106b0
mov rcx, rbx
call fcn.10000fe50
mov rcx, rbx
call fcn.10000fee0
nop
mov rsi, qword [rbx]
jmp 0x100010429
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
jne 0x100010422
mov rdx, rsi
mov rcx, rbx
call fcn.10000f0d0
jmp 0x100010426
and qword [rsi], 0xfffffffffffffffe
mov rsi, rdi
test rsi, rsi
jne 0x100010408
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x10006e280], 0
jle 0x1000104cc
lea rdx, [0x10006e160]
mov rcx, rbx
call fcn.10000f250
mov rsi, rax
test rax, rax
je 0x100010498
mov rax, qword [0x10006e200]
mov qword [rsi + 0x18], rax
cmp qword [0x10006e200], 0
je 0x100010488
mov rax, qword [0x10006e200]
mov qword [rax + 0x10], rsi
nop dword [rax]
mov rax, qword [rbx + 0xa0]
mov qword [0x10006e200], rax
nop
sub word [0x10006e280], 1
cmp word [0x10006e280], 0
sete bl
lea rcx, [0x10006e250]
call fcn.1000106f0
test bl, bl
je 0x1000104cc
lea rcx, [0x10006e250]
call fcn.100010690
nop dword [rax]
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x100012b10
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x70]
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], r12
mov sil, cl
mov rdi, rdx
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
nop
test sil, sil
je 0x100012c4e
movzx eax, sil
sub eax, 0xffffffc0
mov word [rbp - 8], ax
mov word [rbp - 6], 0x3a
mov word [rbp - 4], 0
mov word [rbp - 2], 0
lea rcx, [rbp - 8]
lea r9, [rbp - 0x10]
xor r8, r8
xor edx, edx
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
mov edx, ebx
sub rdx, 1
mov rcx, rdi
call fcn.10000a6b0
mov r8, qword [rdi]
test r8, r8
jne 0x100012b9f
lea r8, [0x10006d570]
lea rcx, [rbp - 8]
lea r9, [rbp - 0x10]
mov edx, ebx
call sub.kernel32.dll_GetFullPathNameW
mov r12d, eax
test eax, eax
jne 0x100012c0b
call sub.kernel32.dll_GetLastError
mov ecx, eax
call fcn.100003b10
lea rcx, [rbp - 0x18]
call fcn.1000092b0
and esi, 0xff
lea edx, [esi + 0x41]
sub edx, 1
and edx, 0xffff
lea rcx, [rbp - 0x20]
call fcn.100009910
mov rdx, qword [rbp - 0x20]
lea r8, [0x10004e23c]
lea rcx, [rbp - 0x18]
call fcn.100009670
mov rdx, qword [rbp - 0x18]
mov rcx, rdi
call fcn.100009fe0
jmp 0x100012ca0
mov eax, ebx
sub rax, 1
mov edx, r12d
cmp rax, rdx
je 0x100012c24
mov edx, r12d
mov rcx, rdi
call fcn.10000a6b0
cmp byte [0x100049600], 0
jne 0x100012ca0
mov rdx, qword [rdi]
lea rcx, [rbp - 0x28]
call fcn.10000aef0
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
call fcn.10000a140
nop dword [rax]
jmp 0x100012ca0
xor edx, edx
xor ecx, ecx
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
mov edx, ebx
sub rdx, 1
mov rcx, rdi
call fcn.10000a6b0
mov rdx, qword [rdi]
test rdx, rdx
jne 0x100012c76
lea rdx, [0x10006d570]
mov ecx, ebx
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x100049600], 0
jne 0x100012ca0
mov rdx, qword [rdi]
lea rcx, [rbp - 0x28]
call fcn.10000aef0
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
call fcn.10000a140
nop
nop
mov rcx, rbp
call fcn.100012ae0
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x30]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100013110
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x128]
xor esi, esi
mov qword [0x10006d4b0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x24]
mov r8d, 0x104
xor ecx, ecx
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
and eax, eax
mov byte [rsp + rax + 0x24], 0
mov r8d, ebx
xor edx, edx
mov rcx, rsp
call fcn.1000132f0
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x10006d4b0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x24]
call fcn.1000032f0
call sub.kernel32.dll_GetCommandLineA
mov qword [0x100049400], rax
mov r14, rax
jmp 0x100013297
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x100013198
cmp byte [r14], 0
je 0x1000132a1
nop
xor dil, dil
mov r12, r14
xor ebx, ebx
jmp 0x100013200
mov al, byte [r14]
cmp al, 1
jb 0x1000131f8
sub al, 0x20
jbe 0x1000131d4
sub al, 2
je 0x1000131e0
jmp 0x1000131f8
test dil, dil
je 0x100013206
add ebx, 1
jmp 0x1000131fc
cmp byte [r14 + 1], 0x22
je 0x1000131f0
test dil, dil
sete dil
jmp 0x1000131fc
add r14, 1
jmp 0x1000131fc
add ebx, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x1000131c0
test esi, esi
je 0x100013294
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.1000132f0
xor dil, dil
mov r14, r12
mov rdx, qword [0x10006d4b0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x100013288
mov al, byte [r14]
cmp al, 1
jb 0x100013278
sub al, 0x20
jbe 0x10001324c
sub al, 2
je 0x100013260
jmp 0x100013278
test dil, dil
je 0x10001328e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x100013284
cmp byte [r14 + 1], 0x22
je 0x100013270
test dil, dil
sete dil
jmp 0x100013284
add r14, 1
jmp 0x100013284
mov al, byte [r14]
mov byte [r13], al
add r13, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x100013238
mov byte [r13], 0
nop
add esi, 1
cmp byte [r14], 0
jne 0x10001319c
mov dword [0x10006d4a0], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x10006d4b0]
call fcn.100010170
mov rax, qword [0x10006d4b0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x128]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret
Function at 0x100020150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x2b0]
mov qword [rbp - 0x290], rbx
mov qword [rbp - 0x288], rdi
mov qword [rbp - 0x280], rsi
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], dl
mov bl, r8b
lea rdx, [0x100053398]
lea rcx, [rbp - 0x278]
call fcn.10000d8a0
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x10002019f
lea rcx, [0x10006d570]
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000201e2
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x1000201bd
clc
jmp 0x1000201c4
bt dword [0x1000526c0], eax
jb 0x1000201da
mov rcx, rbp
call fcn.100020290
test al, al
je 0x1000201da
mov dil, 1
jmp 0x100020260
xor dil, dil
jmp 0x100020260
mov eax, esi
and eax, 0x10
movzx ecx, byte [rbp - 0x10]
lea rdx, [0x10004ad70]
cmp eax, dword [rdx + rcx*4]
sete dil
and bl, dil
je 0x100020260
and esi, 0x400
je 0x100020260
lea rbx, [rbp - 0x278]
lea rdx, [0x100053398]
mov rcx, rbx
call fcn.10000d980
mov rdx, rbx
mov rcx, qword [rbp - 8]
xor r8b, r8b
call fcn.10001fd80
test eax, eax
je 0x10002023c
sub eax, 1
je 0x100020254
jmp 0x10002025c
mov dl, byte [rbp - 0x10]
mov rcx, qword [rbp - 0x278]
xor r8b, r8b
call fcn.100020150
mov dil, al
jmp 0x100020260
mov dil, 1
jmp 0x100020260
xor dil, dil
nop
nop
mov rcx, rbp
call fcn.100020120
mov al, dil
mov rbx, qword [rbp - 0x290]
mov rdi, qword [rbp - 0x288]
mov rsi, qword [rbp - 0x280]
lea rsp, [rbp]
pop rbp
ret

Function at 0x1000203a0
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rsi, rcx
mov edi, edx
mov r12d, r8d
mov r13, r9
mov qword [rbp - 8], 0
nop
mov edx, r12d
mov ecx, edi
xor r9d, r9d
xor r8, r8
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x100020421
movsxd rdx, ebx
sub rdx, 1
lea rcx, [rbp - 8]
call fcn.10000a6b0
cmp ebx, 1
jle 0x100020410
mov r8, qword [rbp - 8]
mov r9d, ebx
mov edx, r12d
mov ecx, edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
nop
mov rcx, rsi
mov rdx, qword [rbp - 8]
xor r8d, r8d
call fcn.100009e80
jmp 0x10002042c
mov rcx, rsi
mov rdx, r13
call fcn.1000078e0
nop
mov rcx, rbp
call fcn.100020380
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000208f0
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
xor ebx, ebx
nop dword [rax]
add ebx, 1
mov eax, ebx
lea rdx, [0x10006ed80]
lea rcx, [rdx + rax*8 - 8]
xor edx, edx
call fcn.1000078e0
mov eax, ebx
lea rdx, [0x10006edc0]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x100020910
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0xc]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x1000209c4
nop
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0xc]
xor r9d, r9d
mov r8d, 0xa
lea rcx, [rbp - 0x18]
call fcn.100008400
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.100016130
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x1000209c4
lea rcx, [0x100020790]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x100020840]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop dword [rax]
nop
mov rcx, rbp
call fcn.1000208d0
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret

Function at 0x100021060
Capabilities:
Check os version

Disassembly:
lea rsp, [rsp - 0xb8]
mov qword [0x10006ee00], 0
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetVersionExA
mov eax, dword [rsp + 0x30]
mov dword [0x10006ec40], eax
mov eax, dword [rsp + 0x24]
mov dword [0x10006ec50], eax
mov eax, dword [rsp + 0x28]
mov dword [0x10006ec60], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x10006ec70], eax
lea rdx, [0x10006ec81]
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.1000032f0
lea rcx, [rsp + 0x34]
call fcn.100004110
mov byte [0x10006ec80], al
lea rcx, [0x1000527d0]
call sub.kernel32.dll_GetModuleHandleA
mov qword [0x10006ee10], rax
test rax, rax
je 0x100021108
mov rcx, qword [0x10006ee10]
lea rdx, [0x1000527e0]
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006ee00], rax
nop
cmp dword [0x10006ec50], 6
jae 0x10002111c
mov dword [0x100049fe0], 0
nop
cmp dword [0x10006ec50], 6
jb 0x100021138
cmp dword [0x10006ec60], 1
jb 0x100021138
mov dword [0x100049ff0], 2
nop
lea rsp, [rsp + 0xb8]
ret
Function at 0x1000221d0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x180]
mov qword [rbp - 0x140], rbx
mov qword [rbp - 0x138], rdi
mov qword [rbp - 0x130], rsi
mov qword [rbp - 0x128], r12
mov qword [rbp - 0x120], r13
mov rsi, rcx
mov rdi, rdx
mov r12d, r8d
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
nop
mov r13, qword [0x1000538d0]
mov eax, dword [0x1000538c8]
mov dword [rbp - 4], eax
mov ebx, dword [0x1000538c0]
lea rcx, [rbp - 0x10]
call fcn.100007860
mov rdx, rsi
lea rcx, [rbp - 0x18]
call fcn.10001c650
mov r8, qword [rbp - 0x18]
xor r9d, r9d
lea rdx, str.filename:
lea rcx, [rbp - 0x10]
call fcn.100007a00
mov rcx, qword [rbp - 0x10]
xor edx, edx
call fcn.100035160
lea rcx, [rbp - 0x18]
call fcn.100007860
mov ecx, r12d
mov r9d, 0xff
lea r8, [rbp - 0x118]
mov rdx, 0xffffffffffffffff
call fcn.100004c20
xor r8d, r8d
lea rdx, [rbp - 0x118]
lea rcx, [rbp - 0x10]
call fcn.100008260
xor r8b, r8b
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.100009140
mov r8, qword [rbp - 0x10]
xor r9d, r9d
lea rdx, str.lenght:
lea rcx, [rbp - 0x18]
call fcn.100007a00
mov rcx, qword [rbp - 0x18]
xor edx, edx
call fcn.100035160
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov rcx, rsi
xor r9, r9
xor r8d, r8d
mov edx, 0x40000000
call sub.kernel32.dll_CreateFileA
mov r13, rax
cmp r13, 0xffffffffffffffff
je 0x1000223b0
mov qword [rsp + 0x20], 0
mov rdx, rdi
lea r9, [rbp - 4]
mov r8d, r12d
mov rcx, r13
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x100022340
cmp r12d, dword [rbp - 4]
sete al
and eax, 0xff
neg eax
je 0x100022340
mov rcx, r13
call sub.kernel32.dll_FlushFileBuffers
mov ebx, eax
mov rcx, r13
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp - 0x18]
call fcn.100007860
mov ecx, dword [rbp - 4]
mov r9d, 0xff
lea r8, [rbp - 0x118]
mov rdx, 0xffffffffffffffff
call fcn.100004c20
xor r8d, r8d
lea rdx, [rbp - 0x118]
lea rcx, [rbp - 0x10]
call fcn.100008260
xor r8b, r8b
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.100009140
mov r8, qword [rbp - 0x10]
xor r9d, r9d
lea rdx, str.dwBytesWritten:
lea rcx, [rbp - 0x18]
call fcn.100007a00
mov rcx, qword [rbp - 0x18]
xor edx, edx
call fcn.100035160
nop
mov rcx, rbp
call fcn.1000221a0
mov eax, ebx
mov rbx, qword [rbp - 0x140]
mov rdi, qword [rbp - 0x138]
mov rsi, qword [rbp - 0x130]
mov r12, qword [rbp - 0x128]
mov r13, qword [rbp - 0x120]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000342f0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
xor bl, bl
cmp dword [0x10006ec40], 2
jne 0x100034408
nop dword [rax]
cmp qword [0x10004ae90], 0
jne 0x100034328
lea rcx, str.secur32.dll
call sub.kernel32.dll_LoadLibraryA
mov qword [0x10004ae90], rax
nop dword [rax]
cmp qword [0x10004ae90], 0x20
jbe 0x100034408
mov rcx, qword [0x10004ae90]
lea rdx, str.LsaFreeReturnBuffer
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006eff0], rax
mov rcx, qword [0x10004ae90]
lea rdx, str.LsaEnumerateLogonSessions
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006f000], rax
mov rcx, qword [0x10004ae90]
lea rdx, str.LsaGetLogonSessionData
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006f010], rax
mov rcx, qword [0x10004ae90]
lea rdx, str.LsaCallAuthenticationPackage
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006efa0], rax
mov rcx, qword [0x10004ae90]
lea rdx, str.LsaConnectUntrusted
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006efb0], rax
mov rcx, qword [0x10004ae90]
lea rdx, str.LsaLookupAuthenticationPackage
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006efc0], rax
mov rcx, qword [0x10004ae90]
lea rdx, str.LsaRegisterLogonProcess
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006efd0], rax
mov rcx, qword [0x10004ae90]
lea rdx, str.LsaDeregisterLogonProcess
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006efe0], rax
mov bl, 1
mov al, bl
nop
lea rsp, [rsp + 0x20]
pop rbx
ret

Function at 0x100046d60
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x80]
mov qword [rbp - 0x10], 0
nop
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
lea rcx, [0x10004c6c0]
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
call sub.advapi32.dll_AllocateAndInitializeSid
or eax, eax
setne cl
call fcn.100014ba0
mov dl, al
lea r8, [rbp - 0x14]
mov rdx, qword [rbp - 0x10]
xor ecx, ecx
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
je 0x100046df4
mov eax, dword [rbp - 0x14]
or eax, eax
setne al
mov byte [rbp - 4], al
jmp 0x100046df8
mov byte [rbp - 4], 0
nop
mov rcx, rbp
call fcn.100046d30
mov al, byte [rbp - 4]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x100048df0
Capabilities:
Get user security identifier

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x80]
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov qword [rbp - 0x10], 0
nop
xor r12d, r12d
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov dword [rbp - 8], 0
mov dword [rbp - 4], 0
mov qword [rsp + 0x20], 0
lea rax, [rbp - 0x14]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 4]
mov qword [rsp + 0x28], rax
mov rdx, rsi
test rsi, rsi
jne 0x100048e61
lea rdx, [0x10006d570]
mov rcx, rbx
test rbx, rbx
jne 0x100048e70
lea rcx, [0x10006d570]
lea r9, [rbp - 8]
xor r8, r8
call sub.advapi32.dll_LookupAccountNameW
mov r13d, eax
test eax, eax
jne 0x100048f1e
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
sete al
and eax, 0xff
neg eax
je 0x100048f1e
mov edx, dword [rbp - 4]
lea rcx, [rbp - 0x10]
call fcn.100009990
mov ecx, dword [rbp - 8]
call fcn.10000eec0
mov qword [rdi], rax
lea rax, [rbp - 0x14]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 4]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x10]
test rax, rax
jne 0x100048ed8
lea rax, [0x10006d570]
mov qword [rsp + 0x20], rax
mov r8, qword [rdi]
mov rdx, rsi
test rsi, rsi
jne 0x100048eef
lea rdx, [0x10006d570]
mov rcx, rbx
test rbx, rbx
jne 0x100048efe
lea rcx, [0x10006d570]
lea r9, [rbp - 8]
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
jne 0x100048f26
mov rcx, qword [rdi]
call fcn.10000ee80
mov qword [rdi], 0
nop
jmp 0x100048f26
call sub.kernel32.dll_GetLastError
mov r12d, eax
nop
mov rcx, rbp
call fcn.100048dd0
mov eax, r12d
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret
Function at 0x14007ce0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x14008b810
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x478
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x498]
mov rax, qword [0x1401c8058]
xor rax, rbp
mov qword [rbp + 0x448], rax
lea rcx, [0x1401db048]
call fcn.14007fa57
cmp qword [rbp + 0x478], 0
je 0x14008b88a
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rbp + 0x478]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x14008b891
xor al, al
jmp 0x14008ba86
mov r8d, 4
lea rdx, [0x14018f080]
mov rcx, qword [rbp + 0x478]
call fcn.14007ec74
test eax, eax
jne 0x14008b8c0
mov rax, qword [rbp + 0x478]
add rax, 8
mov qword [rbp + 0x478], rax
mov r8d, 2
lea rdx, [0x14018f08c]
mov rcx, qword [rbp + 0x478]
call fcn.14007ec74
test eax, eax
jne 0x14008b8ef
mov rax, qword [rbp + 0x478]
add rax, 4
mov qword [rbp + 0x478], rax
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
mov r8d, 0x104
mov rdx, qword [rbp + 0x478]
lea rcx, [rbp + 0x10]
call fcn.14007fdb3
lea rax, [rbp + 0x10]
mov qword [rbp + 0x238], rax
mov dx, 0x2e
mov rcx, qword [rbp + 0x238]
call fcn.14007c019
mov qword [rbp + 0x258], rax
cmp qword [rbp + 0x258], 0
je 0x14008b95f
xor eax, eax
mov rcx, qword [rbp + 0x258]
mov word [rcx], ax
mov rax, qword [rbp + 0x258]
add rax, 2
mov qword [rbp + 0x258], rax
mov qword [rbp + 0x278], 0
mov byte [rbp + 0x294], 0
cmp qword [rbp + 0x258], 0
je 0x14008b9a9
lea rdx, str.HTML
mov rcx, qword [rbp + 0x258]
call fcn.14007f8f4
test eax, eax
je 0x14008b9a9
lea rdx, [0x14018f0a8]
mov rcx, qword [rbp + 0x258]
call fcn.14007f8f4
test eax, eax
jne 0x14008b9d3
mov r8d, 0x17
mov rdx, qword [rbp + 0x238]
mov rcx, qword [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x278], rax
mov byte [rbp + 0x294], 1
jmp 0x14008b9f5
mov r8, qword [rbp + 0x258]
mov rdx, qword [rbp + 0x238]
mov rcx, qword [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x278], rax
cmp qword [rbp + 0x278], 0
jne 0x14008ba06
xor al, al
jmp 0x14008ba86
mov rdx, qword [rbp + 0x278]
mov rcx, qword [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x2b8], rax
cmp qword [rbp + 0x2b8], 0
jne 0x14008ba2f
xor al, al
jmp 0x14008ba86
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rbp + 0x480]
mov qword [rcx], rax
mov rax, qword [rbp + 0x480]
cmp qword [rax], 0
jne 0x14008ba57
xor al, al
jmp 0x14008ba86
mov rdx, qword [rbp + 0x278]
mov rcx, qword [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rbp + 0x488]
mov dword [rcx], eax
mov rax, qword [rbp + 0x488]
cmp dword [rax], 0
jne 0x14008ba84
xor al, al
jmp 0x14008ba86
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14018e770]
call fcn.14007efda
mov rax, rdi
mov rcx, qword [rbp + 0x448]
xor rcx, rbp
call fcn.14007dc1b
lea rsp, [rbp + 0x458]
pop rdi
pop rbp
ret
Function at 0x14007da13
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14012d290
mov rax, rcx
neg rcx
test rax, 7
je 0x14012d2ad
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14012d308
test al, 7
jne 0x14012d2a0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14012d2c1
mov rdx, qword [rax - 8]
test dl, dl
je 0x14012d332
test dh, dh
je 0x14012d32c
shr rdx, 0x10
test dl, dl
je 0x14012d326
test dh, dh
je 0x14012d320
shr rdx, 0x10
test dl, dl
je 0x14012d31a
test dh, dh
je 0x14012d314
shr edx, 0x10
test dl, dl
je 0x14012d30e
test dh, dh
jne 0x14012d2c1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14007da4f
Capabilities:
Query environment variable

Disassembly:
jmp 0x14014e570
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14014e0f0
lea rcx, [rsp + 0x20]
call fcn.14014e140
movzx eax, al
test eax, eax
jne 0x14014e5b5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14014e120
mov rax, qword [rsp + 0x40]
jmp 0x14014e6af
lea rcx, [rsp + 0x20]
call fcn.14014e240
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14014e1e0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.14007dc9d
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14007d5a9
lea rcx, [rsp + 0x28]
call fcn.14007dfd1
movzx eax, al
test eax, eax
jne 0x14014e64f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14007ee40
lea rcx, [rsp + 0x20]
call fcn.14014e120
mov rax, qword [rsp + 0x50]
jmp 0x14014e6af
lea rcx, [rsp + 0x20]
call fcn.14014e240
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14007f9ad
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.14007dc20
lea rcx, [rsp + 0x28]
call fcn.14008000b
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14007ee40
lea rcx, [rsp + 0x20]
call fcn.14014e120
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x14007ddb5
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400bb730
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400bb0b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400bb76f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401dd020]
jmp 0x1400bb779
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret