joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ac60
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp byte [0x14012dec8], 0
jne 0x14004ad8e
lea rcx, str.winspool.drv
call fcn.1400462c0
mov rsi, rax
lea rcx, str.spoolss.dll
call fcn.1400462c0
test rsi, rsi
je 0x14004ad31
lea rdx, str.EnumPrintersA
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
call rdi
mov qword [0x14012dec0], rax
lea rdx, str.OpenPrinterA
mov rcx, rsi
call rdi
mov qword [0x14012de88], rax
lea rdx, str.ClosePrinter
mov rcx, rsi
call rdi
mov qword [0x14012deb0], rax
lea rdx, str.StartDocPrinterA
mov rcx, rsi
call rdi
mov qword [0x14012de90], rax
lea rdx, str.EndDocPrinter
mov rcx, rsi
call rdi
mov qword [0x14012dea8], rax
lea rdx, str.StartPagePrinter
mov rcx, rsi
call rdi
mov qword [0x14012de98], rax
lea rdx, str.EndPagePrinter
mov rcx, rsi
call rdi
mov qword [0x14012dea0], rax
lea rdx, str.WritePrinter
mov rcx, rsi
call rdi
jmp 0x14004ad80
mov qword [0x14012dec0], 0
mov qword [0x14012de88], 0
mov qword [0x14012deb0], 0
mov qword [0x14012de90], 0
mov qword [0x14012dea8], 0
mov qword [0x14012de98], 0
mov qword [0x14012dea0], 0
xor eax, eax
mov qword [0x14012deb8], rax
mov byte [0x14012dec8], 1
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140056830
Capabilities:
Get common file path
Set current directory

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov ebx, r9d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x130], rax
test r8b, r8b
je 0x140056879
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xffffffff
cmp eax, 0x103
setb bpl
jmp 0x14005687b
xor ebp, ebp
mov dword [rdi], 0x88
xor eax, eax
test rsi, rsi
je 0x14005688f
cmp byte [rsi], 0
cmovne rax, rsi
mov qword [rdi + 0x50], rax
mov rcx, rdi
test bl, bl
je 0x1400568a2
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x1400568a8
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov edi, eax
test rsi, rsi
je 0x1400568cc
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xfffffefc
cmp eax, 0xfffffefc
ja 0x1400568cc
mov byte [rsi], 0
test bpl, bpl
je 0x1400568dc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400ba340
mov eax, ebx
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400ba1d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rdx]
bswap r8
xor r8, qword [rcx + 0x70]
mov qword [rcx + 0x70], r8
mov r9, qword [rdx + 8]
bswap r9
xor r9, qword [rcx + 0x78]
pxor xmm0, xmm0
xor r10d, r10d
mov edx, r9d
and edx, 1
mov rax, r9
shr rax, 1
mov qword [rcx + 0x78], rax
neg rdx
movdqu xmm1, xmmword [rcx + r10 + 0x90]
movq xmm2, rdx
pshufd xmm2, xmm2, 0x44
pand xmm2, xmm1
pxor xmm2, xmm0
and eax, 1
shr r9, 2
mov qword [rcx + 0x78], r9
neg rax
movdqu xmm1, xmmword [rcx + r10 + 0xa0]
movq xmm0, rax
pshufd xmm0, xmm0, 0x44
pand xmm0, xmm1
pxor xmm0, xmm2
add r10, 0x20
cmp r10, 0x400
jne 0x1400ba1f0
xor r9d, r9d
nop dword [rax]
mov eax, r8d
and eax, 1
mov rdx, r8
shr rdx, 1
mov qword [rcx + 0x70], rdx
neg rax
movdqu xmm1, xmmword [rcx + r9 + 0x490]
movq xmm2, rax
pshufd xmm2, xmm2, 0x44
pand xmm2, xmm1
pxor xmm2, xmm0
and edx, 1
shr r8, 2
mov qword [rcx + 0x70], r8
neg rdx
movdqu xmm1, xmmword [rcx + r9 + 0x4a0]
movq xmm0, rdx
pshufd xmm0, xmm0, 0x44
pand xmm0, xmm1
pxor xmm0, xmm2
add r9, 0x20
cmp r9, 0x400
jne 0x1400ba260
movdqu xmmword [rcx + 0x70], xmm0
ret

Function at 0x1400bb5b0
Capabilities:
Encode data using xor

Disassembly:
invalid
pop rbx
mov ah, pe_nt_image_headers64
test dword [0xfb448323], esp
mov cl, 6
jg 0x1400bb59c
in eax, 0xb1
cmp byte [rbx], ch
and eax, 0xcde5ae51
cwde
xor ebp, dword [rcx + 0x26430ced]
invalid

Function at 0x1400c7bd4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400c7d28
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400c7d97
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c7d97
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c7d97
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c7d97
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c7d97
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c7d97
cmp dword [rcx + 0xf8], 0
je 0x1400c7d97
mov ecx, ebx
call fcn.1400c7c54
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400c7ebc
nop
cmp dword [rbp + 0x20], 0
je 0x1400c7de5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400c7cf4
int3
Function at 0x1400cffd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x1400cffed
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400d0048
test al, 7
jne 0x1400cffe0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400d0001
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400d0072
test dh, dh
je 0x1400d006c
shr rdx, 0x10
test dl, dl
je 0x1400d0066
test dh, dh
je 0x1400d0060
shr rdx, 0x10
test dl, dl
je 0x1400d005a
test dh, dh
je 0x1400d0054
shr edx, 0x10
test dl, dl
je 0x1400d004e
test dh, dh
jne 0x1400d0001
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400da66c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400da69c
xor eax, eax
jmp 0x1400da75f
mov rbp, rbx
cmp word [rax], si
je 0x1400da6c1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400da6a8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400da6a4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400da5bc
movsxd r14, eax
test eax, eax
jne 0x1400da6ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400da695
mov rcx, r14
call fcn.1400d49c0
mov rdi, rax
test rax, rax
jne 0x1400da718
xor ecx, ecx
call fcn.1400d3e34
jmp 0x1400da6f4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400da5bc
test eax, eax
jne 0x1400da749
mov rcx, rdi
call fcn.1400d3e34
jmp 0x1400da753
xor ecx, ecx
call fcn.1400d3e34
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400da77c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400da803
mov rsi, rbx
cmp word [rax], bp
je 0x1400da7c2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400da7ac
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400da7a8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400d49c0
mov rdi, rax
test rax, rax
je 0x1400da7f0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400bb5b0
mov rbp, rdi
xor ecx, ecx
call fcn.1400d3e34
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x141059058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410591df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141059089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14105906f
add dl, dl
jne 0x141059096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410590f6
xor eax, eax
add dl, dl
jne 0x1410590a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410591ad
add dl, dl
jne 0x1410590b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410590c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410590d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410590dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410590ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14105907e
mov eax, 1
add dl, dl
jne 0x141059106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141059113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410590fb
sub eax, ebx
mov ebx, 1
jne 0x14105914c
mov ecx, 1
add dl, dl
jne 0x14105912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14105913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141059123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141059168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141059175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14105915d
cmp eax, 0x7d00
jae 0x14105919b
cmp eax, 0x500
jb 0x141059196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105907e
cmp eax, 0x7f
ja 0x14105919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410591d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14105907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180007e70
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x180007f45
xor r8d, r8d
test edx, edx
je 0x180007f45
cmp edx, 0x40
jb 0x180007f1b
movdqa xmm2, xmmword [0x180092780]
lea r11d, [r8 + 0x20]
movdqa xmm3, xmmword [0x180092790]
mov r10d, edx
and r10d, 0xffffffc0
nop dword [rax + rax]
movdqu xmm0, xmmword [r8 + rcx]
lea eax, [r11 - 0x10]
movdqa xmm1, xmm2
pxor xmm0, xmm2
pandn xmm0, xmm3
movdqu xmmword [r8 + rcx], xmm0
add r8d, 0x40
movdqu xmm0, xmmword [rax + rcx]
pxor xmm0, xmm2
pandn xmm0, xmm3
movdqu xmmword [rax + rcx], xmm0
mov eax, r11d
movdqu xmm0, xmmword [rax + rcx]
pxor xmm1, xmm0
pandn xmm1, xmm3
movdqu xmmword [rax + rcx], xmm1
lea eax, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rax + rcx]
pxor xmm0, xmm2
pandn xmm0, xmm3
movdqu xmmword [rax + rcx], xmm0
cmp r8d, r10d
jb 0x180007eb0
cmp r8d, edx
jae 0x180007f45
mov eax, r8d
add rax, rcx
sub edx, r8d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor cl, 0x55
not cl
mov byte [rax - 1], cl
sub rdx, 1
jne 0x180007f30
ret
Function at 0x1800080e0
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14d, edx
mov rbx, rcx
xor edx, edx
mov r8d, 0x250
mov rcx, r9
mov rdi, r9
call fcn.18005f850
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x180008134
mov ecx, 0xc0000008
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movsxd rbx, dword [rsp + 0x80]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r15
mov r15b, 1
lea r12d, [r13 + 0x2e]
lea rcx, [0x18009cf20]
cmp ebx, 0xffffffff
je 0x180008174
lea rcx, [rcx + rbx*4]
xor eax, eax
lock cmpxchg dword [rcx], r13d
test eax, eax
jg 0x1800081f3
movzx eax, word [rdi + 0x2c]
lea rdx, [rdi + 0x2c]
cmp r12w, ax
jne 0x18000819d
cmp r13w, word [rdi + 0x2e]
je 0x1800081de
cmp r12w, ax
jne 0x18000819d
cmp r12w, word [rdi + 0x2e]
jne 0x18000819d
cmp r13w, word [rdi + 0x30]
je 0x1800081de
test dword [rdi], 0x440000
je 0x1800081aa
test r15b, r14b
je 0x1800081de
mov rax, 0xffffffffffffffff
cmp word [rdx + rax*2 + 2], r13w
lea rax, [rax + 1]
jne 0x1800081b1
mov rcx, qword [rsi + 8]
lea r8d, [rax*2 + 2]
xor r9d, r9d
call fcn.18003b690
test rax, rax
je 0x180008245
mov ecx, dword [rdi]
mov dword [rax + 0x1c], ecx
inc dword [rsi + 0x1c]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180008253
jmp 0x180008155
mov rcx, qword [0x18009b358]
lea rax, [0x18009b358]
cmp rcx, rax
je 0x180008236
test byte [rcx + 0x1c], r15b
je 0x180008236
cmp byte [rcx + 0x19], 4
jb 0x180008236
mov rcx, qword [rcx + 0x10]
lea r9, str.E:_buildsARK23181_2_trufos_dll_fileLists.c
mov edx, 0x33
mov dword [rsp + 0x20], 0xd0
lea r8, [0x180091490]
call fcn.1800012d0
mov ecx, 0xe8030001
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x180008260
xor r15b, r15b
mov ecx, 0xc000009a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, r15b
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000e240
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, rdx
mov r15, rcx
mov ebx, 0xc0000001
xor r12d, r12d
mov edi, r12d
mov qword [rsp + 0x30], r12
cmp qword [rdx], 0x40
jb 0x18000e3c3
mov edx, 0x400
xor ecx, ecx
lea r9d, [r12 + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x18000e2b7
mov ebx, 0xc000009a
jmp 0x18000e3c3
xor edx, edx
mov r8d, 0x400
mov rcx, rdi
call fcn.18005f850
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, 0x200
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000e311
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
or ebx, 0xe8f00000
jmp 0x18000e3c3
cmp dword [rsp + 0x38], 0x40
jb 0x18000e3c3
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x18000e3c3
mov esi, dword [rdi + 0x3c]
lea ecx, [rsi + 2]
mov rdx, qword [r14]
mov eax, ecx
cmp rax, rdx
jg 0x18000e3c3
cmp ecx, 0x200
jbe 0x18000e3b3
lea eax, [rsi + 2]
mov ecx, eax
cmp rcx, rdx
jg 0x18000e3c3
xor edx, edx
mov r8d, 0x400
mov rcx, rdi
call fcn.18005f850
mov r14d, esi
and r14d, 0x1ff
je 0x18000e372
and esi, 0xfffffe00
mov dword [rsp + 0x50], esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, 0x400
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000e3ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
or ebx, 0xe8f00000
jmp 0x18000e3c3
mov eax, r14d
add rax, rdi
jmp 0x18000e3b7
lea rax, [rdi + rsi]
mov ecx, 0x4550
cmp word [rax], cx
cmove ebx, r12d
test rdi, rdi
je 0x18000e3d9
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18005e1d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18001d750
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movzx ebx, cl
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 5
jne 0x18001d779
mov eax, 0xc00000bb
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rsp + 0x34], 0xc0000001
mov byte [rsp + 0x30], 0
cmp bl, 1
jne 0x18001d894
lock inc dword [0x18009d920]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.18001d9e0
mov ebx, eax
mov dword [rsp + 0x34], eax
test eax, eax
jns 0x18001d804
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18001d96d
test byte [rcx + 0x1c], 1
je 0x18001d96d
cmp byte [rcx + 0x19], 2
jb 0x18001d96d
mov edx, 0xa
lea r9, [0x1800910b0]
mov dword [rsp + 0x20], eax
lea r8, [0x1800911a0]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x18001d96d
mov byte [rsp + 0x30], 1
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.18001e040
mov ebx, eax
mov dword [rsp + 0x34], eax
test eax, eax
jns 0x18001d85f
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18001d96d
test byte [rcx + 0x1c], 1
je 0x18001d96d
cmp byte [rcx + 0x19], 2
jb 0x18001d96d
mov edx, 0xb
lea r9, str.ImpersonateThread
jmp 0x18001d7eb
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18001d967
test byte [rcx + 0x1c], 1
je 0x18001d967
cmp byte [rcx + 0x19], 5
jb 0x18001d967
mov edx, 0xc
jmp 0x18001d957
lock inc dword [0x18009d924]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x18001d8f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18001d8ec
test byte [rcx + 0x1c], 1
je 0x18001d8ec
cmp byte [rcx + 0x19], 2
jb 0x18001d8ec
mov edx, 0xd
mov dword [rsp + 0x20], eax
lea r9, str.Revert_to_original_thread
lea r8, [0x1800911a0]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
or ebx, 0xe8f00000
jmp 0x18001d969
call fcn.18001dd50
mov ebx, eax
mov dword [rsp + 0x34], eax
test eax, eax
jns 0x18001d933
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18001d96d
test byte [rcx + 0x1c], 1
je 0x18001d96d
cmp byte [rcx + 0x19], 2
jb 0x18001d96d
mov edx, 0xe
lea r9, str.StopSystemThread
jmp 0x18001d7eb
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18001d967
test byte [rcx + 0x1c], 1
je 0x18001d967
cmp byte [rcx + 0x19], 5
jb 0x18001d967
mov edx, 0xf
lea r8, [0x1800911a0]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
xor ebx, ebx
mov dword [rsp + 0x34], ebx
test ebx, ebx
jns 0x18001d9b9
cmp byte [rsp + 0x30], 1
jne 0x18001d9b9
call fcn.18001dd50
test eax, eax
jns 0x18001d9b9
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18001d9b9
test byte [rcx + 0x1c], 1
je 0x18001d9b9
cmp byte [rcx + 0x19], 2
jb 0x18001d9b9
mov edx, 0x10
mov dword [rsp + 0x20], eax
lea r9, str.StopSystemThread
lea r8, [0x1800911a0]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180023ea0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0
xor r8d, r8d
xor edx, edx
lea rcx, str.SystemRoot
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [0x18009c86c], eax
test eax, eax
jne 0x180023f29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [0x18009b358]
mov r10, qword [0x18009b358]
cmp r10, rcx
je 0x180023f17
test byte [r10 + 0x1c], 1
je 0x180023f17
cmp byte [r10 + 0x19], 2
jb 0x180023f17
mov edx, 0xa
mov dword [rsp + 0x20], eax
lea r9, [0x1800914b8]
lea r8, str.IrD
mov rcx, qword [r10 + 0x10]
call fcn.1800012d0
add ebx, 0xe8f00000
lea rdi, str.E:_buildsARK23181_2_trufos_dllmiscCommon.c
jmp 0x18002407c
add eax, eax
cmp byte [0x18009b380], 0
je 0x180023f63
mov ecx, 0x24
lea rdi, str.E:_buildsARK23181_2_trufos_dllmiscCommon.c
mov qword [rsp + 0x28], rdi
mov word [rsp + 0x20], cx
xor r9d, r9d
mov r8d, 0x4843573a
mov edx, eax
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x180023f83
mov r8d, eax
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
lea rdi, str.E:_buildsARK23181_2_trufos_dllmiscCommon.c
mov qword [0x18009c878], rax
test rax, rax
jne 0x180023fcd
lea rcx, [0x18009b358]
mov rax, qword [0x18009b358]
cmp rax, rcx
je 0x180023fc3
test byte [rax + 0x1c], 1
je 0x180023fc3
cmp byte [rax + 0x19], 2
jb 0x180023fc3
mov edx, 0xb
lea r8, str.IrD
mov rcx, qword [rax + 0x10]
call fcn.180001070
mov ebx, 0xc000009a
jmp 0x18002407c
mov r8d, dword [0x18009c86c]
mov rdx, rax
lea rcx, str.SystemRoot
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [0x18009c86c], eax
test eax, eax
jne 0x18002403f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [0x18009b358]
mov r10, qword [0x18009b358]
cmp r10, rcx
je 0x180024037
test byte [r10 + 0x1c], 1
je 0x180024037
cmp byte [r10 + 0x19], 2
jb 0x180024037
mov edx, 0xc
mov dword [rsp + 0x20], eax
lea r9, [0x1800914b8]
lea r8, str.IrD
mov rcx, qword [r10 + 0x10]
call fcn.1800012d0
add ebx, 0xe8f00000
jmp 0x18002407c
lea rcx, [0x18009b358]
mov rax, qword [0x18009b358]
cmp rax, rcx
je 0x18002407a
test byte [rax + 0x1c], 1
je 0x18002407a
cmp byte [rax + 0x19], 4
jb 0x18002407a
mov edx, 0xd
mov r9, qword [0x18009c878]
lea r8, str.IrD
mov rcx, qword [rax + 0x10]
call fcn.180001110
xor ebx, ebx
mov dword [rsp + 0x30], ebx
test ebx, ebx
jns 0x1800240f6
mov r8, qword [0x18009c878]
test r8, r8
je 0x1800240f6
cmp byte [0x18009b380], 0
je 0x1800240d5
mov r9d, 0x3f
mov qword [rsp + 0x20], rdi
mov r8d, 0x4843573a
lea rdx, [0x18009c878]
lea rcx, [0x18009cc40]
call fcn.18004be40
mov qword [0x18009c878], 0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [0x18009c878], 0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180024e20
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18009c880]
test rax, rax
jne 0x180024e4d
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x18009c880], rax
test rax, rax
je 0x180024f57
cmp qword [0x18009c898], 0
jne 0x180024e75
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009c898], rax
mov rax, qword [0x18009c880]
cmp qword [0x18009c888], 0
jne 0x180024e9d
lea rdx, str.Process32First
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009c888], rax
mov rax, qword [0x18009c880]
cmp qword [0x18009c890], 0
jne 0x180024ec5
lea rdx, str.Process32Next
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009c890], rax
mov rax, qword [0x18009c880]
cmp qword [0x18009c8a0], 0
jne 0x180024eed
lea rdx, str.GetSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009c8a0], rax
mov rax, qword [0x18009c880]
cmp qword [0x18009ce20], 0
jne 0x180024f23
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x180024f1c
mov rcx, qword [0x18009c880]
lea rdx, str.GetFinalPathNameByHandleW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009ce20], rax
mov rax, qword [0x18009c880]
test rax, rax
je 0x180024f57
cmp qword [0x18009c898], 0
je 0x180024f57
cmp qword [0x18009c888], 0
je 0x180024f57
cmp qword [0x18009c890], 0
je 0x180024f57
cmp qword [0x18009c8a0], 0
je 0x180024f57
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret