joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180090b20
Capabilities:
Get file size
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180132010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, r9
mov r12d, r8d
mov r15, rdx
mov rsi, rcx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rax
xor edi, edi
test rax, rax
je 0x180090b6e
mov dword [rax], edi
mov dword [r9], edi
cmp qword [rcx], 0xffffffffffffffff
je 0x180090ccc
mov eax, 0x100000
mov ebp, r12d
cmp r12d, eax
cmova ebp, eax
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x68]
mov r8d, ebp
mov rdx, r15
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x80004005
test eax, eax
cmovne edx, edi
cmp qword [rsi + 0x28], 0
je 0x180090c99
test edx, edx
je 0x180090c99
mov ecx, dword [rsp + 0x68]
cmp ecx, ebp
jae 0x180090c9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rbx, rdi
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
jne 0x180090be9
xor dil, dil
jmp 0x180090c1c
mov dword [rsp + 0x6c], edi
lea rdx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180090c0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180090c0e
xor dil, dil
jmp 0x180090c1c
mov ebx, dword [rsp + 0x6c]
shl rbx, 0x20
add rbx, rdi
mov dil, 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x48]
call fcn.180007554
nop
mov rcx, qword [rsi + 0x28]
mov r10, qword [rcx]
mov r9, r14
xor r8d, r8d
test dil, dil
cmovne r8, rbx
mov rdx, rax
call qword [r10 + 0x30]
mov edx, eax
xor edi, edi
test eax, eax
jne 0x180090c99
mov dword [rsp + 0x70], edi
mov edx, dword [rsp + 0x68]
add rdx, r15
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
mov r8d, ebp
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x80004005
test eax, eax
cmovne edx, edi
mov ecx, dword [rsp + 0x68]
add ecx, dword [rsp + 0x70]
mov dword [rsp + 0x68], ecx
test eax, eax
je 0x180090bc7
jmp 0x180090c9d
mov ecx, dword [rsp + 0x68]
add dword [r13], ecx
test edx, edx
jne 0x180090cc0
test ecx, ecx
je 0x180090cbc
mov eax, ecx
add r15, rax
sub r12d, ecx
mov eax, 0x100000
jne 0x180090b80
mov al, 1
jmp 0x180090cce
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180090ccc
mov dword [rax], edx
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800a5100
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180096600
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x180132010]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], VarUI4FromDisp
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, VarUI4FromDisp
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov byte [rcx], al
lea rcx, [rsp + 0x24]
call fcn.1800a8f10
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x180096680
cmp dword [rsp + 0x24], 6
jb 0x180096680
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800a5100
add rsp, 0x150
pop rbx
ret

Function at 0x1800966a0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rcx
lea rdx, str.wintrust.dll
lea rcx, [rax - 0x50]
call fcn.180005e38
nop
call fcn.18007cba0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.18007cc40
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.180005de4
lea rdx, str.crypt32.dll
lea rcx, [rsp + 0x48]
call fcn.180005e38
nop
call fcn.18007cba0
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.18007cc40
mov rdi, rax
lea rcx, [rsp + 0x48]
call fcn.180005de4
test rbx, rbx
je 0x1800967f6
test rdi, rdi
je 0x1800967f6
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800c1288
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1800c1128
call fcn.1800abc8c
mov dword [rax], 0x16
call fcn.1800abb3c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800c1110
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1800c1110
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1800c115a
lock or dword [rax + 0x14], 0x10
jmp 0x1800c1110
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1800c1177
mov rcx, qword [rbp + 0x10]
call fcn.1800c421c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800bf96c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1800bfec4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1800c11ce
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1800c1110
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1800c123a
mov rcx, qword [rbp + 0x10]
call fcn.1800bf96c
cmp eax, 0xffffffff
je 0x1800c1221
mov rcx, qword [rbp + 0x10]
call fcn.1800bf96c
cmp eax, 0xfffffffe
je 0x1800c1221
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800bf96c
movsxd rdi, eax
lea rsi, [0x180135280]
mov rcx, rbx
sar rdi, 6
call fcn.1800bf96c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1800c1228
lea rax, [0x180132520]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800c123a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1800c1270
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1800c126c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1800c126c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1800c1113
jmp 0x1800c10e0
Function at 0x1800cf940
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180132010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1800cf9be
and dword [rsp + 0x2c], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
and dword [rsp + 0x28], 0
mov r9d, 2
and qword [rsp + 0x30], 0
mov rdx, 0xffffffff80000002
call fcn.180002900
mov rbx, qword [rsp + 0x20]
test eax, eax
jne 0x1800cf9b0
lea rdx, str.6B3BA4A8_EC7E_4714_9ECF_EB33995B3384
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test rbx, rbx
je 0x1800cf9be
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x180135a48]
test rbx, rbx
je 0x1800cf9f4
jmp 0x1800cf9ee
call qword [rbx + 0x38]
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, rax
call fcn.180004cd8
test eax, eax
js 0x1800cfa4e
xor ecx, ecx
call qword [rbx + 8]
test eax, eax
js 0x1800cfa4e
add rbx, 0x48
cmp qword [rbx], 0
jne 0x1800cf9cc
mov rax, qword [0x1801359d8]
test rax, rax
je 0x1800cfa06
call rax
test eax, eax
js 0x1800cfa4e
mov rbx, qword [0x180135f30]
xor eax, eax
mov rcx, qword [0x180135f38]
jmp 0x1800cfa49
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800cfa45
call qword [rdi + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov rdx, rax
call fcn.180004cd8
test eax, eax
js 0x1800cfa4e
xor ecx, ecx
call qword [rdi + 8]
test eax, eax
js 0x1800cfa4e
mov rcx, qword [0x180135f38]
add rbx, 8
cmp rbx, rcx
jb 0x1800cfa18
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a5100
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800cfa6c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180132010]
xor rax, rsp
mov qword [rbp - 8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov r14d, 1
test eax, eax
js 0x1800cfba9
and dword [rbp - 0x14], 0
lea rdi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
and qword [rbp - 0x20], 0
lea r9d, [r14 + 1]
and dword [rbp - 0x18], 0
lea rcx, [rbp - 0x20]
and qword [rbp - 0x10], 0
mov rbx, 0xffffffff80000002
mov r8, rdi
mov rdx, rbx
call fcn.180002900
test eax, eax
je 0x1800cfb55
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_Extensions
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.180002848
test eax, eax
jne 0x1800cfb0b
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1800cfb07
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
mov r8, rdi
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.180002848
test eax, eax
jne 0x1800cfb36
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1800cfb32
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
mov r9d, 2
lea rcx, [rbp - 0x20]
mov r8, rdi
mov rdx, rbx
call fcn.180002900
test eax, eax
je 0x1800cfb55
mov rcx, qword [rbp - 0x20]
jmp 0x1800cfb9e
lea rbx, str.2345SoftMgr_Shell_Extension
mov rcx, rbx
call fcn.1800abcb4
mov r9d, r14d
lea rdx, str.6B3BA4A8_EC7E_4714_9ECF_EB33995B3384
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1800cfba9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
test rcx, rcx
je 0x1800cfba9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x180135a48]
test rbx, rbx
je 0x1800cfbe4
jmp 0x1800cfbde
mov ecx, r14d
call qword [rbx + 8]
test eax, eax
js 0x1800cfc46
call qword [rbx + 0x38]
mov rcx, qword [rbx]
mov r8d, r14d
mov rdx, rax
call fcn.180004cd8
test eax, eax
js 0x1800cfc46
add rbx, 0x48
cmp qword [rbx], 0
jne 0x1800cfbb7
mov rbx, qword [0x180135f30]
xor eax, eax
mov rdx, qword [0x180135f38]
jmp 0x1800cfc28
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800cfc24
mov ecx, r14d
call qword [rdi + 8]
test eax, eax
js 0x1800cfc46
call qword [rdi + 0x30]
mov rcx, qword [rdi]
mov r8d, r14d
mov rdx, rax
call fcn.180004cd8
test eax, eax
js 0x1800cfc46
mov rdx, qword [0x180135f38]
add rbx, 8
cmp rbx, rdx
jb 0x1800cfbf6
test eax, eax
js 0x1800cfc46
mov rdx, qword [0x1801359d0]
test rdx, rdx
je 0x1800cfc46
mov rcx, qword [0x180134118]
call rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800a5100
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800d0878
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x180132010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ebx, 0x60
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rbx + 0x18]
call fcn.1800a8f10
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x76
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], 1
lea r8, str.LastLoadedDPI
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800d08fe
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18006b890
mov ebx, eax
mov edx, 0x64
mov ecx, ebx
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, eax
mov eax, 0x51eb851f
shl ecx, 4
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800a5100
add rsp, 0xd0
pop rbx
ret

Function at 0x1800d0944
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 0x79], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x180132010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
lea rcx, [rbp + 0x27]
call fcn.1800d122c
nop
xor edi, edi
cmp qword [rbp + 0x37], rdi
je 0x1800d0a41
movdqa xmm0, xmmword [0x1800fe670]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], di
mov r8, qword [rbx + 0x50]
cmp r8, qword [rbx + 0x58]
jne 0x1800d09b7
lea rdx, [0x1800f87c0]
lea rcx, [rbp + 7]
call fcn.18006c190
jmp 0x1800d09d1
cmp qword [r8 + 0x18], 8
jb 0x1800d09c1
mov r8, qword [r8]
lea rdx, [0x1800f8810]
lea rcx, [rbp + 7]
call fcn.18006c190
mov dword [rbp - 0x69], 0x70
mov dword [rbp - 0x65], 0x540
mov qword [rbp - 0x61], rdi
lea rax, str.Open
mov qword [rbp - 0x59], rax
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 0x51], rax
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x39], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rbp - 0x31]
call fcn.1800a8f10
lea rcx, [rbp - 0x69]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop
lea rcx, [rbp + 7]
call fcn.180005ea4
nop
lea rcx, [rbp + 0x27]
call fcn.180005ea4
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800a5100
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800d2414
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x180132010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ebx, 0x60
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rbx + 0x18]
call fcn.1800a8f10
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x76
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], 1
lea r8, str.LastLoadedDPI
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800d249a
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18006b890
mov ebx, eax
mov edx, 0x64
mov ecx, ebx
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, eax
mov eax, 0x51eb851f
shl ecx, 4
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800a5100
add rsp, 0xd0
pop rbx
ret
Function at 0x1800d24e0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180132010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov rax, qword [rcx + 0x58]
cmp qword [rcx + 0x50], rax
je 0x1800d2670
xor eax, eax
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
call fcn.18000e740
lea rsi, vtable.RC::RCDeferStat.0
mov qword [rbp - 9], rsi
lea rcx, [rbp - 9]
call fcn.18000b710
lea rcx, [rbp - 9]
call fcn.18000ba70
lea rcx, [rbp + 0x27]
call fcn.1800d2e54
nop
xor edi, edi
cmp qword [rbp + 0x37], rdi
je 0x1800d2641
lea rcx, [rbp + 0x27]
call fcn.18006c610
test al, al
je 0x1800d2641
movdqa xmm0, xmmword [0x1800fe670]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], di
mov r8, qword [rbx + 0x50]
cmp qword [r8 + 0x18], 8
jb 0x1800d2595
mov r8, qword [r8]
lea rdx, str.__shortcutsoftmgr
lea rcx, [rbp + 7]
call fcn.18006c190
mov dword [rbp - 0x79], 0x70
mov dword [rbp - 0x75], 0x540
mov qword [rbp - 0x71], rdi
lea rax, str.Open
mov qword [rbp - 0x69], rax
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 0x61], rax
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rdi
mov dword [rbp - 0x49], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rbp - 0x41]
call fcn.1800a8f10
lea rcx, [rbp - 0x79]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1800d2612
xor edx, edx
jmp 0x1800d2623
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800d2621
or edx, 0xffffffff
jmp 0x1800d2623
mov edx, eax
lea rcx, [rbp - 9]
call fcn.18000bb40
lea rcx, [rbp - 1]
call fcn.18000e7f0
nop
lea rcx, [rbp + 7]
call fcn.180005ea4
jmp 0x1800d2659
mov edx, 0xfffffffe
lea rcx, [rbp - 9]
call fcn.18000bb40
lea rcx, [rbp - 1]
call fcn.18000e7f0
nop
lea rcx, [rbp + 0x27]
call fcn.180005ea4
nop
mov qword [rbp - 9], rsi
lea rcx, [rbp - 1]
call fcn.18000e790
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800a5100
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x4157c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41594b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415825
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415834
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415853
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415863
cmp rbx, 0x1000
jae 0x41582b
jmp 0x4158cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415875
xor edx, edx
jmp 0x4158c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432400
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415859
jmp 0x415848
call fcn.00463d40
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004364a0
lea rax, [0x004a9a30]
mov ebx, 0x18
nop dword [rax]
call fcn.00436d20
mov rax, qword [rsp + 0x38]
call fcn.00436a60
lea rax, [0x004a9d38]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436d20
mov rax, qword [rsp + 0x30]
call fcn.00436a60
call fcn.004366e0
call fcn.00436500
lea rax, [0x004ab951]
mov ebx, 0x21
call fcn.00434a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004157c0
Function at 0x415980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415ba6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4159f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415a02
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415a25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415a35
cmp rbx, 0x1000
jae 0x4159f9
nop
jmp 0x415ab8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x415a4d
xor esi, esi
jmp 0x415aaa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432480
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415a2b
jmp 0x415a16
call fcn.00463d40
xorps xmm15, xmm15
mov r14, qword [0x005c4590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415b40
nop dword [rax + rax]
call fcn.004364a0
lea rax, [0x004a9d51]
mov ebx, 0x19
call fcn.00436d20
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00436a60
lea rax, [0x004a9d38]
mov ebx, 0x19
call fcn.00436d20
mov eax, dword [rsp + 0x34]
call fcn.00436a60
nop
call fcn.004366e0
call fcn.00436500
lea rax, [0x004a7317]
mov ebx, 0xd
call fcn.00434a00
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415ae0
call fcn.004364a0
lea rax, [0x004a9d51]
mov ebx, 0x19
call fcn.00436d20
mov rax, qword [rsp + 0x38]
call fcn.00436a60
lea rax, [0x004a9d38]
mov ebx, 0x19
call fcn.00436d20
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436a60
call fcn.004366e0
call fcn.00436500
lea rax, [0x004ab230]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00434a00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415980