joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800340c0
Capabilities:
Resume thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov ebx, edx
mov r12, rcx
call fcn.180045210
cmp qword [0x1800b0798], 0
je 0x180034126
lea rcx, [rsp + 0x28]
call fcn.180015da0
nop
mov rax, qword [r12]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, r12
call qword [rax + 0xd0]
mov ebp, eax
test eax, eax
jne 0x18003412a
lea rcx, [rsp + 0x28]
call fcn.180015db0
xor eax, eax
jmp 0x180034199
xor edi, edi
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x18003418d
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + rsi*4]
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x1800b0798]
mov rbx, rax
test rsi, rsi
jne 0x180034161
test rax, rax
je 0x180034180
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
inc rsi
cmp edi, dword [rsp + 0x30]
jge 0x18003418d
jmp 0x180034140
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12 + 8], eax
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.180015db0
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x1800341c0
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov ebx, r9d
mov r13, r8
mov rbp, rdx
mov r12, rcx
lea rcx, [rsp + 0x28]
call fcn.180015da0
nop
mov rax, qword [r12]
mov r8d, ebx
lea rdx, [rsp + 0x28]
mov rcx, r12
call qword [rax + 0xb0]
test eax, eax
jne 0x180034223
lea rcx, [rsp + 0x28]
call fcn.180015db0
xor eax, eax
jmp 0x1800342bf
xor esi, esi
mov ebx, esi
cmp dword [rsp + 0x30], ebx
jle 0x1800342b0
mov edi, esi
test esi, esi
jne 0x180034254
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea r8d, [rsi + 1]
lea rdx, str.SeDebugPrivilege
call fcn.180018dc0
mov esi, 1
mov rax, qword [rsp + 0x28]
mov r9, qword [r12]
mov r8d, dword [rdi + rax]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [r9 + 0x80]
nop
mov r8, r13
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call fcn.180033b10
test eax, eax
je 0x18003429a
mov rax, qword [rsp + 0x28]
mov r8d, dword [rdi + rax]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180015aa0
nop
lea rcx, [rsp + 0x60]
call fcn.180013520
inc ebx
add rdi, 4
cmp ebx, dword [rsp + 0x30]
jl 0x180034233
lea rcx, [rsp + 0x28]
call fcn.180015db0
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x180034800
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1800afbb4]
test eax, eax
jne 0x18003482e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.SeDebugPrivilege
mov r8d, 1
mov ecx, eax
call fcn.180018dc0
mov dword [0x1800afbb4], eax
add rsp, 0x28
ret
Function at 0x180034b10
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x148
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x130], rax
test rdx, rdx
jne 0x180034b4b
mov eax, 0xf0000001
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800190b0
add rsp, 0x148
ret
lea rcx, [0x180081f90]
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x140], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.comctl32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rdi, rdi
je 0x180034c29
test rax, rax
je 0x180034c29
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18001ab30
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.1800346f0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x47
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x49
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18006f678]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18006f650]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18006f640]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18006f660]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.RemoteLoadDll9x_____Can_not_get_function_address
call fcn.1800469b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800190b0
add rsp, 0x148
ret

Function at 0x180035780
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.18001ab30
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800357ff
lea edx, [rdi + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.180019534
test rax, rax
je 0x1800357eb
mov word [rax], di
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800356e0
jmp 0x180035805
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1800afbbc], eax
test eax, eax
je 0x18003581b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800190b0
mov rbx, qword [rsp + 0x278]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x180035850
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.18001ab30
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800358ba
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800356e0
jmp 0x1800358c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1800afbbc], eax
test eax, eax
je 0x1800358d6
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800190b0
mov rbx, qword [rsp + 0x278]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
jmp 0x180035850
Function at 0x180035e30
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180035e59
lea ecx, [rbx + 0x57]
mov dword [0x1800afbbc], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x180035d70]
lea edx, [r9 + 0x20]
call fcn.180035bf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x180035eaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1800afbbc], eax
test eax, eax
je 0x180035eaa
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
jmp 0x180035e30

Function at 0x180036070
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.18001ab30
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800358ba
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800356e0
jmp 0x1800358c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1800afbbc], eax
test eax, eax
je 0x1800358d6
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800190b0
mov rbx, qword [rsp + 0x278]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
jmp 0x180035850

Function at 0x180036080
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x458
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
call fcn.18001ab30
lea rdx, [rsp + 0x20]
lea rcx, str.ALLUSERSPROFILE
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x180036195
lea rcx, [rsp + 0x20]
call fcn.1800355b0
test eax, eax
je 0x18003617c
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x450], rdi
mov word [rsp + 0x230], r12w
call fcn.18001ab30
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180035ec0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180036174
movsxd rdi, ecx
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.1800194ec
mov word [rsp + rdi*2 + 0x20], r12w
mov rdi, qword [rsp + 0x450]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800356e0
mov eax, 1
jmp 0x180036197
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800190b0
add rsp, 0x458
pop r12
pop rsi
pop rbp
pop rbx
ret
jmp 0x180036080
Function at 0x1800361c0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180035e59
lea ecx, [rbx + 0x57]
mov dword [0x1800afbbc], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x180035d70]
lea edx, [r9 + 0x20]
call fcn.180035bf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x180035eaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1800afbbc], eax
test eax, eax
je 0x180035eaa
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
jmp 0x180035e30
Function at 0x180036620
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x458
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
call fcn.18001ab30
lea rdx, [rsp + 0x20]
lea rcx, str.ALLUSERSPROFILE
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x180036195
lea rcx, [rsp + 0x20]
call fcn.1800355b0
test eax, eax
je 0x18003617c
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x450], rdi
mov word [rsp + 0x230], r12w
call fcn.18001ab30
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180035ec0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180036174
movsxd rdi, ecx
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.1800194ec
mov word [rsp + rdi*2 + 0x20], r12w
mov rdi, qword [rsp + 0x450]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800356e0
mov eax, 1
jmp 0x180036197
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800190b0
add rsp, 0x458
pop r12
pop rsi
pop rbp
pop rbx
ret
jmp 0x180036080

Function at 0x1800376f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x180037709
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x18006fcf0]
cmp r11d, 8
jb 0x180037801
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
dec rbx
jne 0x180037730
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x18003782f
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11d
jne 0x180037810
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x18003f9b0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp dword [0x1800afc08], 0
jne 0x18003fa23
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x196
mov word [rsp + 0x20], ax
call fcn.18001ab30
lea rdx, [rsp + 0x20]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18003fa19
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800190b0
add rsp, 0x1d8
ret
mov dword [0x1800afc08], 1
mov eax, 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800190b0
add rsp, 0x1d8
ret

Function at 0x1800403a0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov rsi, rcx
call fcn.18002fa10
test eax, eax
je 0x1800403dc
mov dword [0x1800afc14], 0x32
xor eax, eax
jmp 0x18004047f
xor eax, eax
mov qword [rsp + 0x90], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 4]
lea r8d, [rbx + 1]
mov rdx, rsi
mov dword [0x1800afc14], ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
call fcn.180040240
lea rcx, [rsp + 0x20]
call fcn.1800402e0
test rax, rax
je 0x180040457
lea rcx, [rsp + 0x20]
call fcn.1800402e0
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
test eax, eax
jne 0x18004044f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x18004045b
mov eax, dword [rsp + 0x54]
mov dword [rdi], eax
jmp 0x18004046b
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x180040465
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1800afc14], eax
lea rcx, [rsp + 0x20]
call fcn.180040340
mov eax, ebx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800190b0
mov rsi, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x180041c40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov rbp, rdx
mov rdi, rcx
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
cmp dword [rdi + 0x140], r12d
je 0x180041cca
lea rdx, [rdi + 0xf0]
lea r8d, [r12 + 1]
lea rcx, [rsp + 0x28]
call fcn.1800161d0
nop
or r8d, 0xffffffff
xor edx, edx
lea rcx, [rdi + 0x128]
call fcn.180015b40
lea rdx, [rdi + 0xd8]
lea rcx, [rdi + 0x128]
call fcn.180015ca0
mov dword [rdi + 0x140], r12d
lea rcx, [rsp + 0x28]
call fcn.180016210
cmp qword [rbp + 0x30], 0
je 0x180041ce0
mov rcx, qword [rbp + 0x30]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + 0x30]
jmp 0x180041d18
mov ebx, r12d
cmp dword [rdi + 0x130], ebx
jle 0x180041d26
mov rsi, r12
nop
mov rax, qword [rdi + 0x128]
mov rcx, qword [rsi + rax]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + 0x30]
test eax, eax
jne 0x180041d18
inc ebx
add rsi, 8
cmp ebx, dword [rdi + 0x130]
jl 0x180041cf0
jmp 0x180041d26
mov rcx, rbp
call fcn.180042400
mov r12d, 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r13d
cmp dword [rdi + 0x148], eax
jae 0x180041d46
mov dword [rdi + 0x148], eax
mov ecx, dword [rbp + 0x18]
mov dword [rdi + 0x14c], ecx
mov eax, r12d
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x180042ac0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x180042ad8
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, rbx
mov dword [rbx + 0x44], 0
add rsp, 0x20
pop rbx
jmp fcn.1800177c0
Function at 0x1800450e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800b04fc]
test ecx, ecx
jne 0x1800451ff
mov eax, dword [0x1800b04f8]
cmp eax, 3
ja 0x1800451ff
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800b04f8], eax
call fcn.18002fa50
test eax, eax
je 0x180045126
lea rcx, str.Userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180045133
lea rcx, [0x180073c78]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180045145
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.CreateEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
mov qword [0x1800b04c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserA
mov rcx, rbx
mov qword [0x1800b04c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserW
mov rcx, rbx
mov qword [0x1800b04d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileA
mov rcx, rbx
mov qword [0x1800b04d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileW
mov rcx, rbx
mov qword [0x1800b04e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnloadUserProfile
mov rcx, rbx
mov qword [0x1800b04e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800b04fc], 1
mov qword [0x1800b04f0], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x180045f50
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800b08e4]
test ecx, ecx
jne 0x1800460b4
mov eax, dword [0x1800b08e0]
cmp eax, 3
ja 0x1800460b4
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800b08e0], eax
call fcn.18002fa50
test eax, eax
je 0x180045f96
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180045fa3
lea rcx, [0x1800745e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180045fb5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, rbx
mov qword [0x1800b0890], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessMemoryInfo
mov rcx, rbx
mov qword [0x1800b0898], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
mov qword [0x1800b08a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExW
mov rcx, rbx
mov qword [0x1800b08a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleInformation
mov rcx, rbx
mov qword [0x1800b08b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1800b08b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1800b08c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameA
mov rcx, rbx
mov qword [0x1800b08c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameW
mov rcx, rbx
mov qword [0x1800b08d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x1800b08d8], rax
mov dword [0x1800b08e4], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1800460c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800b098c]
test ecx, ecx
jne 0x1800462e5
mov eax, dword [0x1800b0988]
cmp eax, 3
ja 0x1800462e5
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800b0988], eax
call fcn.18002fa50
test eax, eax
je 0x180046106
lea rcx, str.iphlpapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180046113
lea rcx, [0x180074770]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180046125
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.GetAdapterIndex
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetAdaptersInfo
mov rcx, rbx
mov qword [0x1800b08f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b0900], rax
call fcn.18002fb50
test eax, eax
je 0x180046173
lea rdx, str.GetAdaptersAddresses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b0908], rax
lea rdx, str.GetIfTable
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetIpForwardTable
mov rcx, rbx
mov qword [0x1800b0910], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateIpForwardEntry
mov rcx, rbx
mov qword [0x1800b0918], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteIpForwardEntry
mov rcx, rbx
mov qword [0x1800b0920], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetIpNetTable
mov rcx, rbx
mov qword [0x1800b0928], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SendARP
mov rcx, rbx
mov qword [0x1800b0930], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetTcpTable
mov rcx, rbx
mov qword [0x1800b0938], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUdpTable
mov rcx, rbx
mov qword [0x1800b0940], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNetworkParams
mov rcx, rbx
mov qword [0x1800b0948], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPerAdapterInfo
mov rcx, rbx
mov qword [0x1800b0950], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AddIPAddress
mov rcx, rbx
mov qword [0x1800b0958], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteIPAddress
mov rcx, rbx
mov qword [0x1800b0960], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NotifyAddrChange
mov rcx, rbx
mov qword [0x1800b0968], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NotifyRouteChange
mov rcx, rbx
mov qword [0x1800b0970], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetAdapterIpAddress
mov rcx, rbx
mov qword [0x1800b0978], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800b098c], 1
mov qword [0x1800b0980], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret