joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001da90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001dc47
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001db26
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001d460
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001ca70
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001db17
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140012690
mov dword [rbx + 0x80], 0
jmp 0x14001dc33
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001b8a0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002c9b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13c0
call fcn.140034d40
sub rsp, rax
mov rax, qword [0x14005f010]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov rax, qword gs:[0x58]
mov ebx, ecx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14005fef8], eax
jle 0x14002ca34
lea rcx, [0x14005fef8]
call fcn.140033d58
cmp dword [0x14005fef8], 0xffffffff
jne 0x14002ca34
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetSystemMetrics
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14005fef8]
mov qword [0x14005fed8], rax
call fcn.140033cec
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14002ca50
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x270
call fcn.140033af0
mov edx, eax
mov eax, 0x80000000
add rdx, rdx
shr rdx, 0x20
add eax, edx
test ebx, ebx
jne 0x14002caaf
add eax, 0x80000000
jne 0x14002caaf
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Screen_width_detected__n
call fcn.140033360
mov ecx, ebx
call qword [0x14005fed8]
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140033c90
add rsp, 0x13c0
pop rbx
ret

Function at 0x14002cad0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13c0
call fcn.140034d40
sub rsp, rax
mov rax, qword [0x14005f010]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov rax, qword gs:[0x58]
mov rbx, rcx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14005ff28], eax
jle 0x14002cb55
lea rcx, [0x14005ff28]
call fcn.140033d58
cmp dword [0x14005ff28], 0xffffffff
jne 0x14002cb55
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ShowWindow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14005ff28]
mov qword [0x14005fee0], rax
call fcn.140033cec
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14002cb70
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x270
call fcn.140033af0
mov edx, eax
add rdx, rdx
shr rdx, 0x20
test edx, edx
jne 0x14002cbc1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Window_is_shown__n
call fcn.140033360
mov edx, 5
mov rcx, rbx
call qword [0x14005fee0]
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140033c90
add rsp, 0x13c0
pop rbx
ret
Function at 0x14002cbf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13d0
call fcn.140034d40
sub rsp, rax
mov rax, qword [0x14005f010]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rax, qword gs:[0x58]
mov ebx, ecx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14005fee8], eax
jle 0x14002cc74
lea rcx, [0x14005fee8]
call fcn.140033d58
cmp dword [0x14005fee8], 0xffffffff
jne 0x14002cc74
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14005fee8]
mov qword [0x14005ff00], rax
call fcn.140033cec
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13b4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x34], eax
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x34], eax
inc r8
cmp r8, 0x270
jb 0x14002cc90
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x270
call fcn.140033af0
mov ecx, ebx
call qword [0x14005ff00]
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.140033c90
add rsp, 0x13d0
pop rbx
ret
Function at 0x140033af0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140033b51
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140033b10
mov ecx, dword [r9]
jmp 0x140033c38
cmp ecx, 0x4e0
jb 0x140033c38
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140033b70
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140033bc0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x1400348e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003492a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003492a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003492a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003492a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003492a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003492c
xor al, al
add rsp, 0x28
ret
Function at 0x140002870
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400028ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400028ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400028ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400028ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400028ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400028bc
xor al, al
add rsp, 0x28
ret

Function at 0x141030578
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141030582
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1410305ab
pop rbp
sub rbp, 0x33
sub rbp, 0x1030578
sub rsp, 0x20
jmp 0x1410305ca
mov rax, 0x1030578
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x88626fb
xor byte [rax], dl
inc rax
dec rcx
jne 0x1410305e9
jmp 0x141030600
mov bl, 0x72
adc dh, byte [rax + 0x72]
invalid
Function at 0x10005c7b4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100404e70]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
xor r8d, r8d
mov r11, qword [0x100404f68]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x58], r11
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10005c839
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], 0
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100404e70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10005c85b
mov rax, qword [rsp + 0x88]
mov qword [0x100404f68], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100404f08], rax
xor ecx, ecx
mov rax, qword [0x100404f68]
mov qword [0x1003ff120], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100404ef0], rax
mov dword [0x1003ff110], 0xc0000409
mov dword [0x1003ff114], 1
mov rax, qword [0x100404bb0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100406070]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100077208]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
cmp rcx, qword [0x100404bb0]
jne 0x10030060b
rol rcx, 0x10
test cx, 0xffff
jne 0x100300607
ret 0
ror rcx, 0x10
jmp 0x10005c7b4
Function at 0x10006b9b0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x100404bb0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10006ba1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10006ba0e
mov ebx, 0x80004005
jmp 0x10006ba3b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10006ba37
cmp dword [rsp + 0x30], 2
jne 0x10006ba33
cmp dword [rsp + 0x24], 6
jb 0x10006ba33
mov eax, 1
jmp 0x10006ba35
xor eax, eax
mov dword [rdi], eax
test ebx, ebx
jns 0x10006ba6c
mov rcx, qword [0x1003fe1c8]
lea rax, [0x1003fe1c8]
cmp rcx, rax
je 0x10006ba6c
test byte [rcx + 0x3c], 2
je 0x10006ba6c
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e980]
mov edx, 0x27
mov r9d, ebx
call fcn.10006e778
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1003005f0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x10006c580
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x160
mov rax, qword [0x100404bb0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edi, 0x11c
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8, rdi
xor ebx, ebx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rbp, [0x1003fe1c8]
lea edi, [rbx + 2]
test eax, eax
jne 0x10006c5f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10006c5e8
mov ebx, 0x80004005
jmp 0x10006c629
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10006c625
cmp dword [rsp + 0x34], 6
jae 0x10006c61a
cmp dword [rsp + 0x34], 5
jne 0x10006c616
cmp dword [rsp + 0x38], edi
jne 0x10006c616
cmp word [rsp + 0x144], di
jae 0x10006c61a
xor eax, eax
jmp 0x10006c61f
mov eax, 1
mov dword [0x10041c900], eax
test ebx, ebx
jns 0x10006c653
mov rcx, qword [0x1003fe1c8]
cmp rcx, rbp
je 0x10006c65a
test byte [rcx + 0x3c], dil
je 0x10006c65a
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e920]
mov edx, SafeArrayGetDim
mov r9d, ebx
call fcn.10006e778
mov rcx, qword [0x1003fe1c8]
test ebx, ebx
js 0x10006c70a
xor r9d, r9d
lea r8, [0x10004f118]
lea rcx, [0x10004f150]
lea edx, [r9 + 0x64]
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
test eax, eax
je 0x10006c69b
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10006c703
lea rax, [0x10006c768]
lea rcx, [0x10004ec50]
mov r9d, 0x21
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x4d2
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
test eax, eax
je 0x10006c6e5
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10006c703
lea rcx, [0x10041c8d0]
call fcn.10006e03c
mov ebx, eax
test eax, eax
js 0x10006c703
mov dword [0x10041c904], 1
jmp 0x10006c72d
mov rcx, qword [0x1003fe1c8]
cmp rcx, rbp
je 0x10006c72d
test byte [rcx + 0x3c], dil
je 0x10006c72d
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e920]
mov edx, 0xa
mov r9d, ebx
call fcn.10006e778
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1003005f0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x10006d800
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x40
xor r13d, r13d
mov r12, r9
mov rbp, r8
lea r9, [rax - 0x20]
lea r8d, [r13 + 1]
mov qword [rax - 0x20], r13
mov rbx, r13
call fcn.10006db00
cmp eax, r13d
mov esi, eax
lea r14, [0x1003fe1c8]
jl 0x10006d953
mov dword [rsp + 0x60], r13d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
je 0x10006d88f
movzx esi, ax
or esi, 0x80070000
cmp eax, r13d
cmovle esi, eax
cmp esi, r13d
jne 0x10006d951
cmp rbx, r13
jne 0x10006d8d3
mov eax, dword [rsp + 0x60]
cmp eax, r13d
jbe 0x10006d8c9
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r13
jne 0x10006d84d
mov rbx, r13
mov esi, 0x8007000e
jmp 0x10006d94e
mov esi, 0x8000ffff
jmp 0x10006d953
cmp dword [rsp + 0x30], 4
je 0x10006d8e1
mov esi, 0x8007000d
jmp 0x10006d953
mov edx, dword [rsp + 0x60]
mov ebp, r13d
cmp edx, 4
je 0x10006d928
mov esi, 0x8007000d
mov ebp, esi
mov rcx, qword [0x1003fe1c8]
cmp rcx, r14
je 0x10006d922
test byte [rcx + 0x3c], 2
je 0x10006d922
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e9a0]
mov edx, SafeArrayGetDim
mov r9d, esi
call fcn.10006e778
mov edx, dword [rsp + 0x60]
mov eax, dword [rsp + 0x60]
jmp 0x10006d931
mov eax, dword [rbx]
mov dword [r12], eax
mov eax, r13d
cmp ebp, r13d
mov esi, ebp
jl 0x10006d953
cmp eax, r13d
mov rax, qword [rsp + 0x80]
cmovne rbx, r13
cmp rax, r13
je 0x10006d94e
mov dword [rax], edx
cmp esi, r13d
jge 0x10006d97d
mov rcx, qword [0x1003fe1c8]
cmp rcx, r14
je 0x10006d97d
test byte [rcx + 0x3c], 2
je 0x10006d97d
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e9a0]
mov edx, 0x22
mov r9d, esi
call fcn.10006e778
cmp rbx, r13
je 0x10006d996
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x38], r13
je 0x10006d9a8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov eax, esi
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x1000739a4
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x20], 0
xor eax, eax
mov rsi, rcx
and dword [rcx + 8], eax
and qword [r11 + 8], rax
lea ebp, [rax + 1]
lea r8, [r11 + 8]
lea rcx, [0x10004fc98]
mov edx, ebp
xor r9d, r9d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
xor ebx, ebx
xor edi, edi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x100073a18
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100073a05
mov edi, 0x80004005
jmp 0x100073abc
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x100073ab8
mov rax, qword [rsp + 0x50]
and dword [rsp + 0x30], ebx
lea r8, [0x100050d80]
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
jne 0x100073a6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100073a05
lea r8, [0x100050d80]
xor edx, edx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbx, rax
test rax, rax
je 0x1000739f1
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100073a9c
cmp eax, 0x80
je 0x100073a95
cmp eax, 0x102
jne 0x100073a9f
mov edi, 0x800705b4
jmp 0x100073abc
mov edi, 0x8000ffff
jmp 0x100073abc
mov dword [rsi + 8], ebp
mov rcx, qword [rsi]
mov rbp, rbx
xor ebx, ebx
test rcx, rcx
je 0x100073ab5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsi], rbx
mov qword [rsi], rbp
test edi, edi
jns 0x100073afb
mov rcx, qword [0x1003fe1c8]
lea rax, [0x1003fe1c8]
cmp rcx, rax
je 0x100073aed
test byte [rcx + 0x3c], 2
je 0x100073aed
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e718]
mov edx, 0xb
mov r9d, edi
call fcn.10006e778
test rbx, rbx
je 0x100073afb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100073b0b
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x1000792ac
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov r14, r8
mov r12, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov r15d, eax
mov dword [rsp + 0x80], ecx
mov dword [rsp + 0x40], ecx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
cmp rbp, rcx
je 0x1000796db
call fcn.10005c4dc
nop
enter 0x118c, 0xffffffffffffff90
hlt
mov edi, 0x80070057
call fcn.1002d92b0
nop
and byte [rdi + 0x27403e], 0
loopne 0x10007976b
cmpsd dword [rsi], dword [rdi]
rcr byte ds:[rax + 0x27], 1
cmp esp, dword [rax - 0x72f006c5]
jmp 0x1490796fd
add al, ah
xchg byte [rdi], dil
mov al, 0xd8
test dword [rbx], edx
loopne 0x1000797c2
xchg byte [rdi], bh
sub cl, 0x70
invalid
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x88], esi
mov dword [rsp + 0x40], esi
mov rdi, rsi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x44], eax
cmp rbx, rsi
je 0x100079c5b
cmp word [rbx], si
je 0x100079c5b
call fcn.10030bc70
nop
sbb al, 0xcb
invalid
call fcn.1003d5454
nop
in al, 0x3c
invalid
call fcn.10005c4dc
nop
adc al, 0xe8
add byte ss:[rax - 0x538fc11d], dh
jrcxz 0x100079caa
loopne 0x100079c85
add byte [rax], al
sar byte [rsi - 0x7ff8ffa9], 0x85
test byte [rdi], 0x89
cmpsb byte [rsi], byte [rdi]
invalid
lea rbx, [0x1003fe1c8]
cmp rax, rbx
je 0x100079b48
test byte [rax + 0x3c], 2
je 0x100079b48
call fcn.1002f8014
nop
push rax
mov ah, 0x3f
adc byte [rsi + 1], ch
add byte [rax], dl
push rsp
mov ah, 0x3f
add dword [rax], eax
adc byte [rsp + rsi*4 + 0x3f], dl
mov al, 0x90
or rax, 0xffffffffe35ae850
invalid
Function at 0x100083d50
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x100404bb0]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor esi, esi
mov rdi, rdx
mov byte [rsp + 0x75], 5
mov byte [rsp + 0x70], sil
mov byte [rsp + 0x71], sil
mov byte [rsp + 0x72], sil
mov byte [rsp + 0x73], sil
mov byte [rsp + 0x74], sil
mov qword [rsp + 0x68], rsi
mov ebx, esi
cmp rdx, rsi
jne 0x100083daa
mov ebx, 0x80070057
jmp 0x100083e2e
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, esi
jne 0x100083e0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x100083dfe
mov ebx, 0x80004005
jmp 0x100083e2e
movzx ebx, ax
or ebx, 0x80070000
cmp eax, esi
cmovle ebx, eax
jmp 0x100083e2a
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp eax, esi
je 0x100083ded
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
cmp ebx, esi
jge 0x100083e5f
mov rcx, qword [0x1003fe1c8]
lea rax, [0x1003fe1c8]
cmp rcx, rax
je 0x100083e5f
test byte [rcx + 0x3c], 2
je 0x100083e5f
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e850]
mov edx, 0x2a
mov r9d, ebx
call fcn.10006e778
mov rcx, qword [rsp + 0x68]
cmp rcx, rsi
je 0x100083e6f
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1003005f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret