joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001aa0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001aea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001aea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001aea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001aea
cmp dword [rcx + 0x84], 0xe
jbe 0x140001aea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001aec
xor al, al
add rsp, 0x28
ret

Function at 0x140004f9c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000500b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000500b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000500b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000500b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000500b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000500b
cmp dword [rcx + 0xf8], 0
je 0x14000500b
mov ecx, ebx
call fcn.1400050b0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140004ea4
nop
cmp dword [rbp + 0x20], 0
jne 0x14000506c
call fcn.140007d14
cmp eax, 1
jne 0x14000505c
xor dl, dl
jmp 0x140005066
call fcn.140007ce0
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x140005077
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005080
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140004f9c

Function at 0x140005184
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140004f9c
Function at 0x140007b8c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140007c13
mov rsi, rbx
cmp word [rax], bp
je 0x140007bd2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140007bbc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140007bb8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140005ac0
mov rdi, rax
test rax, rax
je 0x140007c00
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000c9c0
mov rbp, rdi
xor ecx, ecx
call fcn.140005b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c110
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c138
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000c138
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001620
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18000165a
call fcn.1800011c0
test eax, eax
je 0x18000165a
xor eax, eax
lea r8, [0x1800015d0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140002030
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002051
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000207e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002080
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400020d9
test ecx, ecx
jle 0x1400020b9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400020d9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400020d9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
retf
pop rsp
jns 0x14000c52a
ja 0x14000c4f2
loop 0x14000c45b
or byte [rbx + 0x742736dc], ch
invalid
invalid
je 0x14000c525
add byte [rdi], ch
invalid
sub esp, ecx
and dword [rsi + 0x79], ebx
jne str.S:23p
pop rsi
jns 0x14000c565
adc dword [rdi], esi
invalid
loopne 0x14000c4fb
invalid
pop rdx
outsb dx, byte [rsi]
mov ch, 0xcd
jae 0x14000c50e
jle 0x14000c4ea
and al, 0xb2
invalid
xor eax, 0x62a4076
jb 0x14000c53f
test al, 0x6f
cmp dword [0x1a202a6ee], 0xee78f912
scasd eax, dword [rdi]
xchg ecx, eax
cmp eax, 0x517696b1
mov cl, 0x96
jbe 0x14000c579
invalid
xlatb
adc esi, dword [rbx + 0x69]
sub ecx, ebx
jle 0x14000c534
pop rsi
push rcx
jnp 0x14000c540
jrcxz 0x14000c524
imul esp, dword [rdx + 0x38], 0xe817ce62
call 0x18d5a0205
sar dword [rcx + rbx*2], 0x4d
mov cs, word [rax]
mov ah, 0xc2
xor eax, dword [rbx + 0x5c]
or byte [rcx + 0x6b324338], ah
cmp byte [rbx + 0x32], al
imul ebp, dword [rbx + 0x234c206d], 0x26
sub dh, byte [rcx - 0x4d]
int1
and eax, 0x227593ee
jne 0x14000c582
outsb dx, byte [rsi]
imul edx, dword [rdx + rax*2 + 0x31], 0x218b3efe
loopne 0x14000c4ed
invalid
or eax, 0x3cf61d6e
out 0xb2, al
invalid
lea ebp, [0x178277c82]
movabs byte [0x9ec92e35345c7ca8], al
jl 0x14000c5df
xor al, 0x35
leave
sahf
push rax
outsd dx, dword [rsi]
invalid
Function at 0x140002100
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002122
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002131
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002154
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002156
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002192
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000222e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400021cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000220e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000222e
cmp rbx, rax
ja 0x1400021e0
test rbx, rbx
je 0x14000222e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
push 0x9026f25
xor al, 0x41
xchg esp, eax
and bh, byte [rbx + 0x5f]
jns 0x14000c472
outsd dx, dword [rsi]
or dword [rbx], ebp
cld
invalid
Function at 0x140002690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400026bd
xor eax, eax
jmp 0x140002829
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400026f7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400026f7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002829
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000281c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000273a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002765
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002821
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400027d4
sub eax, 1
je 0x1400027d4
cmp eax, 2
jne 0x14000281c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002821
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002802
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000281c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002821
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003460
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002bd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002ca3
cmp byte [rcx + 0x71], 0
je 0x140002ca3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002c9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002c64
sub eax, 1
je 0x140002c68
cmp eax, 2
jne 0x140002c9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003460
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002c96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002c9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002c4c
xor al, al
jmp 0x140002c4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003460
add rsp, 0x60
pop rbx
ret

Function at 0x140003e14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003e5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003e5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003e5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003e5e
cmp dword [rcx + 0x84], 0xe
jbe 0x140003e5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003e60
xor al, al
add rsp, 0x28
ret
Function at 0x7ff7c8e43390
Capabilities:
Get hostname

Disassembly:
mov r11, rsp
push rbp
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x7ff7c8ea3088]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor bpl, bpl
mov rdi, rdx
mov r14, rcx
test rcx, rcx
je 0x7ff7c8e43568
test rdx, rdx
je 0x7ff7c8e43568
mov qword [r11 - 0x20], rsi
xor edx, edx
mov r8d, 0x600
mov qword [r11 - 0x28], r15
mov rcx, rdi
call fcn.7ff7c8e5c560
xor r15d, r15d
mov dword [rdi], 0x57333244
mov esi, 0x105
cmp byte [r14 + 0x38], r15b
jne 0x7ff7c8e434d3
and dword [rdi + 0xc], 0xff3ff321
mov eax, 0x3905
or dword [rdi + 0xc], 0x300321
mov word [rdi + 0x1c], ax
mov eax, dword [rdi + 0xc]
cmp byte [r14 + 0x24], r15b
je 0x7ff7c8e43429
cmp dword [r14 + 0x20], 2
je 0x7ff7c8e43429
and eax, 0xffff0fff
jmp 0x7ff7c8e43432
and eax, 0xffff1fff
bts eax, 0xc
mov dword [rdi + 0xc], eax
cmp byte [r14 + 0x2c], r15b
je 0x7ff7c8e4344b
and dword [rdi + 0xc], 0xfff1ffff
or dword [rdi + 0xc], 0x10000
jmp 0x7ff7c8e434ac
and dword [rdi + 0xc], 0xfff0ffff
lea r8, [rdi + 0x27e]
mov rcx, qword [r14]
test rcx, rcx
jne 0x7ff7c8e4346c
lea rcx, [rdi + 0x74]
call fcn.7ff7c8e54e10
jmp 0x7ff7c8e434ac
lea r9, [rsp + 0x20]
mov qword [rsp + 0x290], rbx
mov edx, 0x104
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rdx, [rdi + 0x74]
mov r8, rsi
lea rcx, [rdi + 0x27e]
call fcn.7ff7c8e505c0
mov rbx, qword [rsp + 0x290]
test al, al
je 0x7ff7c8e43552
lea rcx, [rdi + 0x486]
mov dword [rsp + 0x28], 0x10
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rdi + 0x5a8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp byte [r14 + 0x39], r15b
je 0x7ff7c8e4354f
cmp byte [r14 + 0x3a], r15b
jne 0x7ff7c8e4354f
mov byte [rdi + 0x5fc], 1
lea r9, str.zdmp
add rdi, 0x74
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.7ff7c8e432d0
test eax, eax
je 0x7ff7c8e43543
lea rcx, [rsp + 0x30]
sub rcx, rdi
nop word [rax + rax]
lea rax, [rsi + 0x7ffffef9]
test rax, rax
je 0x7ff7c8e43532
movzx eax, word [rcx + rdi]
test ax, ax
je 0x7ff7c8e43532
mov word [rdi], ax
add rdi, 2
sub rsi, 1
jne 0x7ff7c8e43510
test rsi, rsi
lea rax, [rdi - 2]
cmovne rax, rdi
mov word [rax], r15w
jmp 0x7ff7c8e4354f
lea rcx, str.__Error:_Could_not_rename_file_extension._n
call fcn.7ff7c8e51110
mov bpl, 1
mov r15, qword [rsp + 0x250]
movzx eax, bpl
mov rsi, qword [rsp + 0x258]
jmp 0x7ff7c8e4356a
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.7ff7c8e589f0
add rsp, 0x260
pop r14
pop rdi
pop rbp
ret
Function at 0x7ff7c8e458b0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x7ff7c8ea3088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
cmp qword [rcx + 0x68], 0
je 0x7ff7c8e45a80
cmp byte [rcx + 0x71], 0
je 0x7ff7c8e45a80
mov rax, qword [rcx]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.7ff7c8e491c0]
or edx, 0xffffffff
mov rcx, r15
call rbx
cmp eax, 0xffffffff
jne 0x7ff7c8e4591c
xor al, al
jmp 0x7ff7c8e45a82
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], 0
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call 0x7ff7c8e4b8b0
nop
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
nop dword [rax]
lea r9, [rbp - 0x30]
cmp rdx, 0x10
cmovae r9, rcx
lea r14, [rbp - 0x30]
cmovae r14, rcx
mov rsi, qword [r15 + 0x68]
mov rdx, qword [rsi]
mov rbx, qword [rbp - 0x20]
add rbx, r9
mov rdi, qword [rdx + 0x40]
mov rcx, rdi
call qword [fcn.7ff7c8e491c0]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r14
lea rdx, [r15 + 0x74]
mov rcx, rsi
call rdi
test eax, eax
je 0x7ff7c8e459a2
sub eax, 1
jne 0x7ff7c8e45a18
jmp 0x7ff7c8e459a7
mov byte [r15 + 0x71], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x7ff7c8e459f4
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, rcx
mov r9, qword [r15 + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.7ff7c8e634e0
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x7ff7c8e45a25
cmp byte [r15 + 0x71], 0
je 0x7ff7c8e45a29
test rbx, rbx
jne 0x7ff7c8e45950
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call 0x7ff7c8e4b370
jmp 0x7ff7c8e45941
sub eax, 2
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x7ff7c8e45a29
xor bl, bl
jmp 0x7ff7c8e45a2b
mov bl, 1
cmp rdx, 0x10
jb 0x7ff7c8e45a7b
lea rax, [rdx + 1]
cmp rax, 0x1000
jb 0x7ff7c8e45a76
test byte [rbp - 0x30], 0x1f
je 0x7ff7c8e45a49
call fcn.7ff7c8e60e0c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x7ff7c8e45a58
call fcn.7ff7c8e60e0c
int3
sub rcx, rax
cmp rcx, 8
jae 0x7ff7c8e45a67
call fcn.7ff7c8e60e0c
int3
cmp rcx, 0x27
jbe 0x7ff7c8e45a73
call fcn.7ff7c8e60e0c
int3
mov rcx, rax
call fcn.7ff7c8e58a14
movzx eax, bl
jmp 0x7ff7c8e45a82
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.7ff7c8e589f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x7ff7c8e50920
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x7ff7c8ea3088]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov word [rbp + 0x3b], 0x500
lea rax, [rbp + 0x27]
mov dword [rbp + 0x43], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x37]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rbp + 0x3f], ebx
mov dword [rbp + 0x37], ebx
mov qword [rbp + 0x27], rbx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7ff7c8e509ab
mov rdx, qword [rbp + 0x27]
lea r8, [rbp + 0x43]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rbp + 0x43]
test eax, eax
cmove ecx, ebx
mov dword [rbp + 0x43], ecx
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x7ff7c8e509ba
call qword [sym.imp.ADVAPI32.dll_FreeSid]
lea rax, [rbp + 0x2f]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x37]
mov dword [rsp + 0x48], ebx
mov dl, 1
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
lea r8d, [r9 + 0x12]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7ff7c8e50a0d
mov rdx, qword [rbp + 0x2f]
lea r8, [rbp + 0x3f]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rbp + 0x3f]
test eax, eax
cmove ecx, ebx
mov dword [rbp + 0x3f], ecx
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x7ff7c8e50a1c
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp byte [rbp + 0x3f], bl
jne 0x7ff7c8e50a2a
cmp byte [rbp + 0x43], bl
jne 0x7ff7c8e50a2a
xor al, al
jmp 0x7ff7c8e50a2c
mov al, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.7ff7c8e589f0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x7ff7c8e51350
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x7ff7c8ea3088]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x7ff7c8e5140c
mov r9, rbx
mov qword [rsp + 0x20], 0x80
mov r8d, 0x80
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x30]
call fcn.7ff7c8e64074
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x7ff7c8e513eb
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x7ff7c8e513e2
lea rcx, str.__Error:_Gethostbyname___cannot_retrieve_IP_from_hostname._r_n
call fcn.7ff7c8e51110
xor ebx, ebx
jmp 0x7ff7c8e513eb
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ebx, dword [rcx]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.7ff7c8e589f0
add rsp, 0x270
pop rbx
ret
mov edx, eax
lea rcx, str.__Error:__WSAStartup_failed:__d_r_n
call fcn.7ff7c8e51110
mov ecx, 1
call fcn.7ff7c8e63c48
int3
Function at 0x7ff7c8e546d0
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor r9d, r9d
mov dword [rsp + 0x20], 0
movzx edi, r8w
mov rsi, rdx
mov rbx, rcx
xor r8d, r8d
lea rcx, [0x7ff7c8e97d28]
lea edx, [r9 + 1]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx], rax
test rax, rax
jne 0x7ff7c8e54736
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._Error:_WinHttpOpen_failed_with_error_code___d_n
call fcn.7ff7c8e566b0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
movzx r8d, di
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rbx + 8], rax
test rax, rax
jne 0x7ff7c8e54778
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._Error:_WinHttpConnect_failed_with_error_code___d_n
call fcn.7ff7c8e566b0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 0x1bb
cmp di, ax
sete al
mov byte [rbx + 0x10], al
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff7c8e54e10
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x7ff7c8ea3088]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, r8
mov rdi, rcx
mov r8d, 0x208
lea rcx, [rsp + 0x90]
xor edx, edx
call fcn.7ff7c8e5c560
xor esi, esi
mov dword [rsp + 0x58], 0x10
mov word [rdi], si
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov word [rbx], si
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x7ff7c8e54f11
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx ecx, word [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
movzx r8d, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
movzx eax, word [rsp + 0x6c]
movzx r10d, word [rsp + 0x60]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x38], edx
mov edx, 0x104
mov dword [rsp + 0x30], r8d
lea r8, str._s__04d_02d_02d__02d_02d_02d.dmp
mov dword [rsp + 0x28], r9d
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], r10d
call fcn.7ff7c8e4f2d0
lea r9, [rsp + 0x50]
mov r8, rbx
mov edx, 0x104
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x7ff7c8e54f11
mov r8d, 0x105
mov rdx, rdi
mov rcx, rbx
call fcn.7ff7c8e505c0
movzx eax, al
jmp 0x7ff7c8e54f13
mov eax, esi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.7ff7c8e589f0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret