joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa50
mov rax, qword [0x1400540b8]
xor rax, rsp
mov qword [rsp + 0xa40], rax
mov r9d, dword [rcx + 0x10]
lea r8, str._ld_s
mov rsi, rcx
mov qword [rsp + 0x20], rdx
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140001090
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdi, qword [rsi + 8]
lea r9, [rsp + 0x40]
mov r8d, 0x200
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x38]
lea ebx, [rax*2 + 2]
movsxd rax, ebx
mov qword [rsp + 0x20], rax
call fcn.14002b928
lea r8d, [rbx*2 + 2]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov rcx, rdi
lea rdx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x14000f1ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_WriteFile_failed._Error_code__ld_n
call fcn.140001030
lea eax, [rdi + 1]
jmp 0x14000f29d
lea rdx, [0x14004c988]
lea rcx, [rsp + 0x40]
call fcn.140027684
test eax, eax
je 0x14000f22b
lea rdx, [0x14004c998]
lea rcx, [rsp + 0x40]
call fcn.140018820
test rax, rax
jne 0x14000f22b
lea rdx, str.DISCONNECT
lea rcx, [rsp + 0x40]
call fcn.140018820
test rax, rax
je 0x14000f22f
xor eax, eax
jmp 0x14000f29d
mov r9d, dword [rsi + 0x10]
lea r8, str._ldOK
mov edx, 0x200
lea rcx, [rsp + 0x640]
call fcn.140001090
xor ecx, ecx
call fcn.14002ad78
xor ecx, ecx
mov rbx, rax
call fcn.14002ad78
sub rax, rbx
cmp rax, 2
jge 0x14000f29b
nop word [rax + rax]
lea rdx, [rsp + 0x640]
mov rcx, rsi
call fcn.14000f2d0
test eax, eax
je 0x14000f22b
xor ecx, ecx
call fcn.14002ad78
sub rax, rbx
cmp rax, 2
jl 0x14000f270
mov eax, 1
jmp 0x14000f29d
mov eax, edi
mov rcx, qword [rsp + 0xa40]
xor rcx, rsp
call fcn.140016da0
lea r11, [rsp + 0xa50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000f2d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xe50
mov rax, qword [0x1400540b8]
xor rax, rsp
mov qword [rsp + 0xe40], rax
mov rsi, qword [rcx + 8]
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov edi, r14d
mov rbp, rdx
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.1400180a0
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
jne 0x14000f353
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14000f3b0
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0x200
mov r8d, 0x200
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x38]
call fcn.14002b33c
mov eax, 0x200
lea rcx, [rsp + 0x240]
sub eax, edi
lea r9, [rsp + 0x640]
movsxd rdx, eax
lea r8, [0x140047240]
movsxd rax, edi
lea rcx, [rcx + rax*2]
call fcn.140001090
add edi, eax
test ebx, ebx
je 0x14000f310
cmp dword [rsp + 0x30], r14d
je 0x14000f3ff
lea rax, [rsp + 0x240]
mov r9, rbp
sub r9, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x14000f3e4
add rax, 2
test ecx, ecx
jne 0x14000f3d0
test edx, edx
je 0x14000f406
mov r8, rbp
lea rdx, [rsp + 0x240]
lea rcx, str.Invalid_response_nreceived____s_nexpected____s_n
call fcn.140001030
mov eax, 1
jmp 0x14000f409
mov eax, r14d
mov rcx, qword [rsp + 0xe40]
xor rcx, rsp
call fcn.140016da0
lea r11, [rsp + 0xe50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000ff70
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x50
mov rdi, rcx
xor ebx, ebx
mov dword [rcx + 8], ebx
mov rcx, rdx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rdi + 0x10]
lea r14, [rdi + 0x10]
mov rbp, rax
test rcx, rcx
je 0x14000ffc0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14000ffb3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [r14], rbx
mov qword [rdi + 0x18], rbx
call qword [sym.imp.ole32.dll_CoUninitialize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x14000ffdb
mov dword [rdi + 8], eax
mov ebx, 1
jmp 0x1400100c3
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 3
lea edx, [r9 - 1]
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, 0x80000000
mov esi, eax
add eax, ecx
test ecx, eax
jne 0x140010034
cmp esi, 0x80010119
je 0x140010034
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rdi + 8], esi
mov ebx, 1
jmp 0x1400100be
xor edx, edx
mov qword [rsp + 0x78], r15
lea r15, [rdi + 0x18]
lea r9, [0x140047230]
mov qword [rsp + 0x20], r15
lea rcx, [0x140047220]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
jns 0x14001006d
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rdi + 8], esi
jmp 0x1400100b4
mov rcx, qword [r15]
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rdx, rbp
mov qword [rsp + 0x30], rbx
mov rax, qword [rcx]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
call qword [rax + SafeArrayPutElement]
test eax, eax
jns 0x1400100b9
mov rcx, qword [r15]
mov dword [rdi + 8], eax
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [r14], rbx
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, 1
mov r15, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x140013da0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1400540b8]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rsi, r8
lea rcx, str.DDDriverInstall.exe
mov rbx, rdx
mov r8d, 0x103
lea rdx, [rbp + 0x1f0]
mov edi, r9d
call 0x140005100
mov rcx, qword [0x1400571e8]
mov rax, qword [rcx]
call qword [rax + 0x108]
test eax, eax
je 0x140013e15
mov rcx, qword [0x1400571e8]
lea rdx, [0x140048e88]
mov rax, qword [rcx]
call qword [rax + 0xe0]
mov ecx, 1
call fcn.14001b364
mov rcx, rax
call fcn.1400201e0
lea r9, [rbp + 0x1f0]
mov edx, 0x103
lea rcx, [rbp - 0x20]
test edi, edi
je 0x140013e81
mov eax, dword [rbp + 0x450]
test rsi, rsi
je 0x140013e66
mov dword [rsp + 0x38], eax
lea r8, str.__s___s___s___USBVID__.4XPID__.4X___nul
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
call fcn.140001090
jmp 0x140013e92
mov dword [rsp + 0x30], eax
lea r8, str.__s___s__USBVID__.4XPID__.4X___nul
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call fcn.140001090
jmp 0x140013e92
lea r8, str.__s___s__nul
mov qword [rsp + 0x20], rbx
call fcn.140001090
xor edx, edx
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1400180a0
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x58], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov dword [rbp - 0x54], 0x100
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140013f60
mov rax, qword [0x1400571e8]
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400571e8]
lea rdx, str.CreateProcess___Failed__x
mov r8d, eax
call qword [rbx + 0x50]
mov rcx, qword [0x1400571e8]
mov r8, qword [rcx]
call qword [r8 + 0x108]
test eax, eax
je 0x140013f59
mov rcx, qword [0x1400571e8]
lea rdx, [0x140048e88]
mov r8, qword [rcx]
call qword [r8 + 0xf0]
mov eax, 1
jmp 0x140013fdd
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400571e8]
mov rax, qword [rcx]
call qword [rax + 0x108]
test eax, eax
je 0x140013fc1
mov rcx, qword [0x1400571e8]
lea rdx, [0x140048e88]
mov rax, qword [rcx]
call qword [rax + 0xf0]
mov rcx, qword [0x1400571e8]
lea r8, [rbp - 0x20]
lea rdx, str.Calling____s_
mov rax, qword [rcx]
call qword [rax + 0x50]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140016da0
mov rbx, qword [rsp + 0x530]
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020ad4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140020967
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140020967
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140020967
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140020967
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140020967
cmp dword [rcx + 0x84], 0xe
jbe 0x140020967
cmp dword [rcx + 0xf8], 0
je 0x140020967
mov ecx, ebx
call fcn.140020a08
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400207f8
cmp dword [rbp + 0x20], 0
je 0x1400209b4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400209bc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140020900
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x40105b
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x40109f
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x40109a
cmp rbx, r11
jae 0x40109f
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x401088
cmp rbx, r11
jb 0x4010a3
xor eax, eax
jmp 0x4010af
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x402460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov rax, rsp
sub rsp, 0x68
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov rsi, rdx
mov r12, rcx
mov rdx, qword [rdx]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12 + 0x188]
sub rdi, 0x18
mov ebx, 0xffffffff
cmp rcx, rdi
je 0x4024ff
cmp dword [rdi + 0x10], 0
jl 0x4024ee
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x4024ee
call fcn.00417a50
mov r13, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x4024e0
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r13 + 0x18]
mov qword [r12 + 0x188], rax
jmp 0x4024ff
mov r8d, dword [rdx - 0x10]
lea rcx, [r12 + 0x188]
call fcn.00417880
mov rcx, qword [r12 + 0x190]
xor edi, edi
test rcx, rcx
je 0x40251b
call fcn.004389b0
mov qword [r12 + 0x190], rdi
mov qword [rsp + 0x20], rdi
lea r8, [0x00458714]
mov rdx, qword [rsi]
lea rcx, [rsp + 0x20]
call fcn.00436a50
mov rcx, qword [rsp + 0x20]
test rcx, rcx
setne dil
test rcx, rcx
je 0x40254a
call fcn.004389b0
lea r8, [0x00458718]
mov rdx, qword [rsi]
lea rcx, [r12 + 0x190]
call fcn.00436a50
mov r9, qword [r12 + 0x190]
test r9, r9
je 0x4025af
test eax, eax
jne 0x4025af
test edi, edi
jne 0x40258f
mov word [rsp + 0x70], 0xfeff
lea edx, [rax + 2]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x70]
call fcn.00438590
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x4025ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x402626
mov r8, rsi
lea rdx, str.ERROR:_Opening_log_file:__
lea rcx, [rsp + 0x28]
call fcn.00417200
nop
lea r8, str.__failed_
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.00417070
mov rdx, rax
mov rcx, r12
call fcn.004022e0
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x402605
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x402621
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x22
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
add rsp, 0x68
ret
Function at 0x405dc0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov rcx, qword [rcx + 0x178]
test rcx, rcx
je 0x405ded
call fcn.004389b0
mov qword [rdi + 0x178], 0
mov rdx, qword [rdi + 0x170]
cmp dword [rdx - 0x10], 0
je 0x405e35
lea r8, [0x00459190]
lea rcx, [rdi + 0x178]
call fcn.00436a50
mov r9, qword [rdi + 0x178]
test r9, r9
je 0x405e79
test eax, eax
jne 0x405e79
lea edx, [rax + 2]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x20], 0xfeff
call fcn.00438590
mov eax, dword [rdi + 0x98]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
cmp eax, 1
jne 0x405eee
mov rbx, qword [rdi + 0x90]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
cmp dword [rbx - 8], 0
mov rcx, rax
jl 0x405e8d
cmp rax, qword [rbx - 0x18]
jne 0x405e8d
lea rbp, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x405eca
mov eax, 0x22
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
mov rax, qword [rax]
mov edx, dword [rbx - 0x10]
mov r8d, 2
call qword [rax]
test rax, rax
mov rbp, rax
jne 0x405ea9
call fcn.00417bc0
int3
mov eax, dword [rbx - 0x10]
lea rcx, [rbp + 0x18]
mov r8, rbx
mov dword [rbp + 8], eax
mov eax, dword [rbx - 0x10]
add eax, 1
movsxd rdx, eax
add rdx, rdx
mov r9, rdx
call fcn.00438330
lea rax, [rbp + 0x18]
lea r8, [fcn.0040c3f0]
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov qword [rsp + 0x28], rax
call fcn.00408530
mov ebx, eax
jmp 0x406003
cmp eax, 4
jne 0x405f83
mov rbx, qword [rdi + 0x90]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
cmp dword [rbx - 8], 0
mov rcx, rax
jl 0x405f22
cmp rax, qword [rbx - 0x18]
jne 0x405f22
lea rbp, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x405f5f
mov rax, qword [rax]
mov edx, dword [rbx - 0x10]
mov r8d, 2
call qword [rax]
test rax, rax
mov rbp, rax
jne 0x405f3e
call fcn.00417bc0
int3
mov eax, dword [rbx - 0x10]
lea rcx, [rbp + 0x18]
mov r8, rbx
mov dword [rbp + 8], eax
mov eax, dword [rbx - 0x10]
add eax, 1
movsxd rdx, eax
add rdx, rdx
mov r9, rdx
call fcn.00438330
lea rax, [rbp + 0x18]
lea r8, [fcn.0040c3f0]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov qword [rsp + 0x30], rax
call fcn.0040a3f0
mov ebx, eax
jmp 0x406003
mov rbx, qword [rdi + 0x90]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
cmp dword [rbx - 8], 0
mov rcx, rax
jl 0x405fae
cmp rax, qword [rbx - 0x18]
jne 0x405fae
lea rbp, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x405feb
mov rax, qword [rax]
mov edx, dword [rbx - 0x10]
mov r8d, 2
call qword [rax]
test rax, rax
mov rbp, rax
jne 0x405fca
call fcn.00417bc0
int3
mov eax, dword [rbx - 0x10]
lea rcx, [rbp + 0x18]
mov r8, rbx
mov dword [rbp + 8], eax
mov eax, dword [rbx - 0x10]
add eax, 1
movsxd rdx, eax
add rdx, rdx
mov r9, rdx
call fcn.00438330
lea rax, [rbp + 0x18]
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov qword [rsp + 0x38], rax
call fcn.0040c3f0
mov ebx, eax
mov rcx, qword [rdi + 0x178]
test rcx, rcx
je 0x40601f
call fcn.004389b0
mov qword [rdi + 0x178], 0
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x414410
Capabilities:
Get domain controller name

Disassembly:
mov qword [rsp + 0x10], rdx
mov rax, rsp
sub rsp, 0x88
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
mov r13d, r9d
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
xor r15d, r15d
mov qword [rax + 8], r15
xor eax, eax
mov rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, [0x004586ec]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x004586ec]
lea rcx, [rsi + 8]
call fcn.00417880
mov dword [rsi + 0x10], r15d
mov dword [rsi + 0x14], r15d
mov dword [rsi + 0x18], r15d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x4144a9
mov rax, qword [rcx]
lea edx, [rbx + 2]
call qword [rax]
mov qword [rsi + 0x20], r15
mov rdx, qword [rbp]
cmp dword [rdx - 0x10], r15d
jne 0x4144d6
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x4144cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x2b
jmp 0x41459c
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x41457a
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax + 0x28]
test rdx, rdx
jne 0x414513
mov ecx, r15d
jmp 0x414525
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
lea rcx, [rsi + 8]
call fcn.00417880
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x414543
call sub.NETAPI32.dll_NetApiBufferFree
mov dword [rsi + 0x10], r14d
mov dword [rsi + 0x14], r13d
mov eax, dword [rsp + 0xb0]
mov dword [rsi + 0x18], eax
mov qword [rsi + 0x20], r15
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x414576
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x41459c
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x414597
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x2b
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
add rsp, 0x88
ret
Function at 0x417570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov eax, r8d
mov rbp, rdx
mov qword [rsp + 0x40], rsi
shr eax, 4
add ax, 1
mov ebx, r8d
mov rsi, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x4176d5
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x4176d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x4176d5
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x417616
nop
cmp rdi, r11
jae 0x4176d5
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x417600
cmp rdi, r11
jae 0x4176d5
movzx eax, word [rdi]
test ax, ax
je 0x4176d5
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x41764c
mov edx, ebx
mov rcx, rsi
call fcn.004179f0
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x41766c
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.00438330
test eax, eax
je 0x4176ab
cmp eax, 0xc
je 0x4176a5
cmp eax, 0x16
je 0x41769f
cmp eax, 0x22
je 0x41769f
cmp eax, 0x50
je 0x4176ab
call fcn.00427700
int3
call fcn.00427700
int3
call fcn.004276dc
int3
test ebx, ebx
js 0x4176ca
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x4176ca
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x4176d7
mov ecx, 0x80070057
call entry0
int3
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x43b7b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0046ff68]
jne 0x4368ea
rol rcx, 0x10
test cx, 0xffff
jne 0x4368e6
repz ret
ror rcx, 0x10
jmp 0x43b710
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004757d0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004758c8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x43b795
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004757d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x43b7b7
mov rax, qword [rsp + 0x88]
mov qword [0x004758c8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00475868], rax
mov rax, qword [0x004758c8]
mov qword [0x00475740], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00475850], rax
mov dword [0x00475730], 0xc0000409
mov dword [0x00475734], 1
mov rax, qword [0x0046ff68]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0046ff70]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004757c8], eax
mov ecx, 1
call fcn.00442540
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00456918]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004757c8], 0
jne 0x43b83e
mov ecx, 1
call fcn.00442540
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret