joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b42b4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400b42ca
mov al, 1
jmp 0x1400b432a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400b42db
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400b4328
mov ecx, dword [rcx + 0x18]
nop
call fcn.140042151
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b4328
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400b4328
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400b4328
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400b432a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x2fc4d5ab0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6b90
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d64b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d654a
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d652e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d6522
cmp qword [rbp - 0x10], 0
je 0x2fc4d6522
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d64e8
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d654b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6650
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6678
mov eax, 0
jmp 0x2fc4d66c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d66a1
mov eax, 0
jmp 0x2fc4d66c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d66c1
mov eax, 0
jmp 0x2fc4d66c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d66cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d674a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d6741
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d6741
mov rax, qword [rbp - 8]
jmp 0x2fc4d675f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d6714
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d1160
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d2240
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d1b62
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d1bfa
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d1bde
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d1bd2
cmp qword [rbp - 0x10], 0
je 0x2fc4d1bd2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d1b98
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d1bfb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d1d00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d1d28
mov eax, 0
jmp 0x2fc4d1d76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d1d51
mov eax, 0
jmp 0x2fc4d1d76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d1d71
mov eax, 0
jmp 0x2fc4d1d76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d1d7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d1dfa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d1df1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d1df1
mov rax, qword [rbp - 8]
jmp 0x2fc4d1e0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d1dc4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5720
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6800
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d6122
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d61ba
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d619e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d6192
cmp qword [rbp - 0x10], 0
je 0x2fc4d6192
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6158
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d61bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d62c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d62e8
mov eax, 0
jmp 0x2fc4d6336
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6311
mov eax, 0
jmp 0x2fc4d6336
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6331
mov eax, 0
jmp 0x2fc4d6336
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d633c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d63ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d63b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d63b1
mov rax, qword [rbp - 8]
jmp 0x2fc4d63cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d6384
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800047a4
Capabilities:
List tcp connections and listeners

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
call qword [sym.imp.WS2_32.dll_htons]
lea ecx, [rbx + 0x1c]
movzx esi, ax
mov dword [rsp + 0x48], ecx
call fcn.1800a89d0
mov rdi, rax
test rax, rax
je 0x180004866
mov dword [rsp + 0x28], ebx
lea r9d, [rbx + 2]
lea r8d, [rbx + 1]
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x180004838
mov rcx, rdi
call fcn.1800a89bc
mov ecx, dword [rsp + 0x48]
call fcn.1800a89d0
mov rdi, rax
test rax, rax
je 0x180004866
mov dword [rsp + 0x28], ebx
lea r9d, [rbx + 2]
lea r8d, [rbx + 1]
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x18000485e
mov ecx, ebx
cmp dword [rdi], ebx
jbe 0x18000485e
mov rax, rdi
lea rdx, [rax + 0x18]
movzx eax, word [rax + 0xc]
cmp eax, esi
je 0x18000485c
inc ecx
mov rax, rdx
cmp ecx, dword [rdi]
jb 0x180004845
jmp 0x18000485e
mov ebx, dword [rdx]
mov rcx, rdi
call fcn.1800a89bc
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800098f0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov byte [rcx + 8], 0
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test eax, eax
je 0x180009948
mov ecx, edi
call fcn.18009d8b4
mov rcx, qword [rbx]
mov qword [rbx], rax
call fcn.18009d1f4
mov r9, qword [rbx]
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x180009948
mov byte [rbx + 8], 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000dea0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov edx, dword [rcx + 0x30]
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0xb0]
xor ebx, ebx
mov dword [rbp + 0xb0], 0x100
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x70]
mov rdi, rcx
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x18000df5a
lea rcx, [rdi + 0x38]
or rsi, 0xffffffffffffffff
lea rax, [rbp - 0x70]
inc rsi
cmp byte [rax + rsi], bl
jne 0x18000df0f
cmp rsi, qword [rcx + 0x18]
ja 0x18000df43
cmp qword [rcx + 0x18], 0x10
mov r14, rcx
jb 0x18000df2a
mov r14, qword [rcx]
mov qword [rcx + 0x10], rsi
lea rdx, [rbp - 0x70]
mov rcx, r14
mov r8, rsi
call fcn.18009fc20
mov byte [r14 + rsi], bl
jmp 0x18000df52
lea r9, [rbp - 0x70]
mov r8b, bl
mov rdx, rsi
call fcn.180003a38
inc dword [rdi + 0x30]
jmp 0x18000dfea
cmp eax, 0x103
jne 0x18000e011
lea rax, [rdi + 0x38]
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 0x10
jb 0x18000df77
mov rax, qword [rax]
movdqa xmm1, xmmword [0x1800ebed0]
lea rcx, [rdi + 0x60]
mov byte [rax], bl
xorps xmm0, xmm0
lea rax, [rsp + 0x48]
mov qword [rdi + 0x58], rbx
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x58], xmm1
cmp rcx, rax
je 0x18000dfe8
mov r8b, bl
lea rdx, [rsp + 0x48]
call fcn.180007418
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18000dfe8
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000dfe3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e00b
call fcn.18009d1f4
mov bl, 1
lea r11, [rsp + 0x190]
mov byte [rdi + 0x80], bl
mov rbx, qword [r11 + 0x30]
mov rax, rdi
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800a45b8
int3
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov edx, eax
call fcn.18000fcf8
lea rdx, [0x1800fe618]
lea rcx, [rsp + 0x40]
call fcn.18009edd8
int3
Function at 0x18000e1e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xa0
mov r15, r8
mov r13, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x49], xmm0
and qword [rbp - 0x39], 0
lea rcx, [rbp - 0x49]
call fcn.18000e530
mov rdi, qword [rbp - 0x39]
mov rbx, rdi
mov r14, qword [rbp - 0x49]
sub rbx, r14
mov rsi, qword [rbp - 0x41]
mov rax, rsi
sub rax, r14
cmp rbx, rax
jae 0x18000e24b
mov rsi, rdi
mov qword [rbp - 0x41], rdi
jmp 0x18000e264
jbe 0x18000e264
sub rbx, rax
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.1800a02d0
add rsi, rbx
mov qword [rbp - 0x41], rsi
mov r12, rsi
sub r12, r14
mov dword [rbp + 0x77], r12d
test r15, r15
je 0x18000e28a
lea rdx, str._Default_
mov rcx, r15
call fcn.1800b08cc
test eax, eax
jne 0x18000e28a
xor edx, edx
jmp 0x18000e28d
mov rdx, r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x51]
xor r8d, r8d
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
je 0x18000e2d2
mov rbx, r14
mov r15, r14
test r14, r14
jne 0x18000e35c
test eax, eax
jne 0x18000e3a3
mov r15, qword [rbp + 0x6f]
mov ebx, dword [rbp + 0x77]
cmp rbx, r12
jae 0x18000e2e0
lea rsi, [rbx + r14]
jmp 0x18000e31a
jbe 0x18000e31e
mov rax, rdi
sub rax, r14
cmp rbx, rax
jbe 0x18000e307
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.18000ea54
mov rdi, qword [rbp - 0x39]
mov rsi, qword [rbp - 0x41]
mov r14, qword [rbp - 0x49]
jmp 0x18000e31e
sub rbx, r12
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.1800a02d0
add rsi, rbx
mov qword [rbp - 0x41], rsi
sub rsi, r14
mov eax, dword [rbp + 0x77]
cmp rsi, rax
jne 0x18000e351
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x51]
xor r8d, r8d
mov rdx, r15
mov rax, qword [rbp + 0x5f]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x18000e356
mov eax, 8
mov rbx, r14
mov r15, r14
test eax, eax
jne 0x18000e3a3
mov r9d, dword [rbp + 0x77]
mov r8, r14
mov edx, dword [rbp - 0x51]
mov rcx, r13
call fcn.18000dde8
nop
test r15, r15
je 0x18000e3f3
sub rdi, r15
cmp rdi, 0x1000
jb 0x18000e39e
add rdi, 0x27
sub r15, qword [r14 - 8]
lea rax, [r15 - 8]
cmp rax, 0x1f
ja 0x18000e430
mov r15, qword [r14 - 8]
mov rcx, r15
jmp 0x18000e3eb
cmp eax, 5
je 0x18000e3ae
cmp byte [rbp + 0x7f], 0
jne 0x18000e411
xor r9d, r9d
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.18000dde8
nop
test rbx, rbx
je 0x18000e3f3
sub rdi, rbx
cmp rdi, 0x1000
jb 0x18000e3e8
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18000e430
mov rbx, rcx
mov rcx, rbx
mov rdx, rdi
call fcn.18009d1f4
mov rax, r13
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
mov edx, eax
lea rcx, [rbp - 0x31]
call fcn.18000fcf8
lea rdx, [0x1800fe618]
lea rcx, [rbp - 0x31]
call fcn.18009edd8
nop
call fcn.1800a45b8
int3
Function at 0x18000ed58
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
call fcn.18000cdc4
test eax, eax
je 0x18000eda4
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x30]
test rax, rax
je 0x18000eda9
call rax
jmp 0x18000edaf
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0xb0]
xor r9d, r9d
mov rcx, qword [rsi]
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x18000edfa
mov qword [rbx], rax
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x18]
mov qword [rbx + 8], rax
add rax, rdi
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov edx, eax
call fcn.18000fcf8
lea rdx, [0x1800fe618]
lea rcx, [rsp + 0x30]
call fcn.18009edd8
int3

Function at 0x18000f3c4
Capabilities:
Get token privileges

Disassembly:
push rdi
sub rsp, 0x30
cmp byte [0x18010ce32], 0
jne 0x18000f44e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, 1
test rax, rax
je 0x18000f447
lea r8, [rsp + 0x50]
mov rcx, rax
lea edx, [rdi + 0x17]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000f447
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
and dword [rsp + 0x40], 0
lea r9d, [rdi + 3]
and dword [rsp + 0x48], 0
lea r8, [rsp + 0x40]
lea edx, [rdi + 0x1c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x18000f43c
movzx eax, byte [0x18010ce31]
cmp dword [rsp + 0x40], 0
cmova eax, edi
mov byte [0x18010ce31], al
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x18010ce32], dil
mov al, byte [0x18010ce31]
add rsp, 0x30
pop rdi
ret

Function at 0x18000ff84
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x80
and dword [rax - 0x54], 0
mov rdi, r9
and dword [rax - 0x58], 0
mov r9d, r8d
mov r8, rdx
mov dword [rax - 0x68], 0x67452301
lea rdx, [rax - 0x68]
mov dword [rax - 0x64], 0xefcdab89
mov rbx, rcx
mov dword [rax - 0x60], 0x98badcfe
mov dword [rax - 0x5c], 0x10325476
call fcn.18000fdfc
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.18000fee0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x180010d38
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov qword [rcx], rbx
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rdi], rax
test rax, rax
je 0x180010e50
lea rdx, str.HttpSendRequestA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010ce80], rax
test rax, rax
je 0x180010e50
mov rcx, qword [rdi]
lea rdx, str.InternetOpenA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010ce78], rax
test rax, rax
je 0x180010e50
mov rcx, qword [rdi]
lea rdx, str.InternetSetOptionA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010ce70], rax
test rax, rax
je 0x180010e50
mov rcx, qword [rdi]
lea rdx, str.InternetConnectA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010ce68], rax
test rax, rax
je 0x180010e50
mov rcx, qword [rdi]
lea rdx, str.HttpOpenRequestA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010ce60], rax
test rax, rax
je 0x180010e50
mov rcx, qword [rdi]
lea rdx, str.HttpQueryInfoA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010ce58], rax
test rax, rax
je 0x180010e50
mov rcx, qword [rdi]
lea rdx, str.InternetCloseHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010ce50], rax
test rax, rax
je 0x180010e50
mov rcx, qword [rdi]
lea rdx, str.InternetSetStatusCallback
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x18010ce48], rax
setne bl
mov byte [rdi + 8], bl
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret