joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x7d0]
sub rsp, 0x8d0
mov rax, qword [0x180135070]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
xor ecx, ecx
call fcn.180007190
mov rcx, rax
call fcn.1800068dc
call fcn.1800068b0
lea r11, str.YGOQVGHYL_P
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
movsxd r10, r8d
imul r10, r10, 0x3c
or rax, 0xffffffffffffffff
lea rcx, [r10 + r11]
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x180004070
xor ebx, ebx
movsxd r8, eax
mov edx, ebx
test eax, eax
jle 0x1800040b9
lea rcx, [rsp + 0x78]
mov r9, r10
sub r9, rcx
add r9, r11
nop word [rax + rax]
lea rcx, [rsp + 0x78]
add rcx, rdx
inc rdx
movzx eax, byte [r9 + rcx]
xor al, 0x18
mov byte [rcx], al
cmp rdx, r8
jl 0x1800040a0
mov rcx, qword [0x180239a38]
lea rax, [r8 + r10]
lea rdx, [rsp + 0x78]
movzx eax, byte [rax + r11]
mov r9d, 1
mov byte [rsp + r8 + 0x78], al
lea r8, [0x180120864]
call fcn.18001ec80
mov rcx, rax
mov qword [0x1802395c8], rax
call fcn.180021f70
mov edi, eax
test eax, eax
jne 0x18000422f
mov rcx, qword [0x1802395c8]
call fcn.180022950
lea rcx, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x30]
lea rdx, str._2d__3s__4d
mov rcx, rax
mov dword [rsp + 0x48], 0x6e616a
mov dword [rsp + 0x4c], 0x626566
mov dword [rsp + 0x50], 0x72616d
mov dword [rsp + 0x54], 0x727061
mov dword [rsp + 0x58], 0x79616d
mov dword [rsp + 0x5c], 0x6e756a
mov dword [rsp + 0x60], 0x6c756a
mov dword [rsp + 0x64], 0x677561
mov dword [rsp + 0x68], 0x706573
mov dword [rsp + 0x6c], 0x74636f
mov dword [rsp + 0x70], 0x766f6e
mov dword [rsp + 0x74], 0x636564
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], 0x7e3
call fcn.180005e40
mov byte [rsp + 0x3b], bl
nop dword [rax]
movsxd rax, ebx
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rcx + rax*4]
call fcn.180005964
test eax, eax
je 0x1800041c5
inc ebx
cmp ebx, 0xc
jl 0x1800041a0
mov ebx, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180007190
lea rcx, [rsp + 0x40]
call fcn.180006de0
mov ecx, dword [rsp + 0x34]
add ecx, 0xfffff894
mov dword [rax + 0x10], ebx
mov dword [rax + 0x14], ecx
mov edx, dword [rsp + 0x30]
mov rcx, rax
mov dword [rax + 0xc], edx
call fcn.180005d8c
cmp qword [rsp + 0x40], rax
js 0x18000425e
mov rcx, qword [0x1802395c8]
call fcn.18001c910
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.180005860
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
lea r8, [rsp + 0x78]
lea rcx, [rbp - 0x40]
call fcn.180001450
lea r8, str.CatiaV5_RLM_License_Error
lea rdx, [rbp - 0x40]
mov r9d, setsockopt
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.1800077f4
int3
lea r8, [0x180121090]
lea rdx, str.Windows
mov r9d, setsockopt
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call fcn.1800077f4
int3

Function at 0x1800077f4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.18000765c
Function at 0x180015910
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x80], 0
jne 0x18001593e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18001595f
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180015add
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180015997
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180015add
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x1800159b6
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180015add
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x1800159e2
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x180015abf
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call fcn.18000e810
test eax, eax
jne 0x180015aba
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0xc], 0
je 0x180015a47
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0x10], 0
jne 0x180015a49
jmp 0x180015abf
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x180015a8f
mov rax, qword [rsp + 0x28]
cmp dword [rax + 4], 0x727444
je 0x180015a91
jmp 0x180015abf
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180015aab
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x28]
jmp 0x180015add
jmp 0x1800159d8
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180015add
add rsp, 0x78
ret
Function at 0x180015af0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.18000abd0
jmp 0x180015b38
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, gethostbyname
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x180015b58
jmp 0x180015bf5
cmp dword [rsp + 0x70], 0x1000
jne 0x180015b7d
mov eax, dword [rsp + 0x74]
and eax, 0xff
cmp eax, 1
je 0x180015b7d
mov eax, dword [rsp + 0x74]
and eax, 0x100
test eax, eax
je 0x180015b7f
jmp 0x180015b23
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180015bb5
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x68]
ja 0x180015bb5
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x180015bba
jmp 0x180015b23
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4550
jne 0x180015b23
mov rax, qword [rsp + 0x20]
jmp 0x180015bf7
xor eax, eax
add rsp, 0x88
ret

Function at 0x1800166f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180016910
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800167f7
mov rax, qword [0x1801365d0]
cmp qword [rsp + 0x20], rax
jb 0x180016754
mov rax, qword [0x1801365d8]
cmp qword [rsp + 0x20], rax
ja 0x180016754
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180016716
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18000abd0
mov r8d, gethostbyname
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180016783
jmp 0x1800167f7
cmp dword [rsp + 0x50], 0x10000
jne 0x1800167da
cmp qword [rsp + 0x48], 0x10000
jb 0x1800167da
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800167c8
mov rax, qword [rsp + 0x28]
jmp 0x1800167f9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800167f2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180016910
mov qword [rsp + 0x20], rax
jmp 0x180016716
xor eax, eax
add rsp, 0x68
ret
Function at 0x180016800
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180016950
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180016903
mov rax, qword [0x1801365d0]
cmp qword [rsp + 0x20], rax
jb 0x18001685b
mov rax, qword [0x1801365d8]
cmp qword [rsp + 0x20], rax
ja 0x18001685b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18001681d
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18000abd0
mov r8d, gethostbyname
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18001688a
jmp 0x180016903
cmp dword [rsp + 0x50], 0x10000
jne 0x1800168e1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800168e1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800168cf
mov rax, qword [rsp + 0x28]
jmp 0x180016905
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800168fe
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180016950
mov qword [rsp + 0x20], rax
jmp 0x18001681d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800169a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180016f30
mov qword [rsp + 0x28], 0
cmp qword [0x1801594a8], 0
jne 0x1800169e8
cmp qword [0x1801594a0], 0
je 0x1800169e8
mov rax, qword [0x1801594a0]
mov qword [0x1801594a8], rax
cmp qword [0x1801594a8], 0
je 0x180016a8e
mov rax, qword [0x1801594a8]
cmp qword [rax + 0x10], 0
je 0x180016a8e
mov rax, qword [0x1801594a8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180016a8e
mov rax, qword [0x1801594a8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180016a8e
mov rax, qword [0x1801594a8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180016a54
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180016a5b
xor eax, eax
jmp 0x180016c09
mov rax, qword [0x1801594a8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.18000abd0
mov rax, qword [rsp + 0x28]
jmp 0x180016c09
mov rax, qword [0x1801594a0]
mov qword [0x1801594a8], rax
jmp 0x180016ab0
mov rax, qword [0x1801594a8]
mov rax, qword [rax + 8]
mov qword [0x1801594a8], rax
cmp qword [0x1801594a8], 0
je 0x180016afd
cmp qword [0x1801594a8], 0
je 0x180016afb
mov rax, qword [0x1801594a8]
cmp qword [rax + 0x10], 0
je 0x180016afb
mov rax, qword [0x1801594a8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180016afb
mov rax, qword [0x1801594a8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180016afb
jmp 0x180016a2c
jmp 0x180016a9e
mov rcx, qword [rsp + 0x60]
call fcn.180018e80
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180016c10
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180016c07
mov rax, qword [rsp + 0x48]
mov qword [0x1801594a8], rax
mov rax, qword [0x1801594a8]
mov dword [rax], 0x52727464
mov rax, qword [0x1801594a8]
mov qword [rax + 0x10], 0
mov rax, qword [0x1801594a8]
mov rcx, qword [0x1801594a0]
mov qword [rax + 8], rcx
mov rax, qword [0x1801594a8]
mov qword [0x1801594a0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1801594a8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180016bb8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180016bf2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180016bae
mov rax, qword [0x1801594a8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180016a2c
xor eax, eax
add rsp, 0x58
ret
Function at 0x180018640
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1801594b8], eax
je 0x18001865c
mov eax, 0x10dd
jmp 0x180018779
mov rax, qword [0x1801594d0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180018702
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800186d2
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x1800186d2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.180017070
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.180005840
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x180018668
mov qword [0x1801594d0], 0
call fcn.180017ad0
mov rax, qword [0x1801594c8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180018762
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.180005840
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18001871e
mov qword [0x1801594c8], 0
mov dword [0x1801594b8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180018cb0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1801594bc], 0
je 0x180018ccd
mov eax, dword [0x1801594bc]
jmp 0x180018d91
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x180018ce1
xor eax, eax
jmp 0x180018d91
mov ecx, select
call fcn.180007834
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180018d4a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180018d2f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.180005840
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1801594bc], eax
mov qword [0x1801594c0], 0
mov eax, dword [rsp + 0x20]
jmp 0x180018d91
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180018d66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x180018d0a
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1801594c8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1801594c8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x18001bc00
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x180135070]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x1d0], 0
mov eax, 1
mov word [rsp + 0x1d4], ax
lea rdx, [rsp + 0x30]
movzx ecx, word [rsp + 0x1d4]
call qword [sym.imp.WSOCK32.dll_WSAStartup]
mov dword [rsp + 0x1d0], eax
mov eax, dword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.180005860
add rsp, 0x1e8
ret
Function at 0x180022a10
Capabilities:
Get session user name

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rax, qword [0x180135070]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x150], 0x100
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
movsxd rax, dword [rsp + 0x178]
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x170]
call fcn.18000abd0
movsxd rax, dword [rsp + 0x178]
mov r8, rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x170]
call fcn.1800fa530
mov eax, dword [rsp + 0x178]
dec eax
cdqe
mov rcx, qword [rsp + 0x170]
mov byte [rcx + rax], 0
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x20], rax
jmp 0x180022ac4
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x180022b88
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
and eax, 0xff
mov ecx, eax
call fcn.180012280
test eax, eax
je 0x180022b07
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
and eax, 0xff
mov ecx, eax
call fcn.180008b38
mov rcx, qword [rsp + 0x20]
mov byte [rcx], al
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
and eax, 0xff
mov ecx, eax
call fcn.180012204
test eax, eax
je 0x180022b29
mov rax, qword [rsp + 0x20]
mov byte [rax], 0x5f
jmp 0x180022b83
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
cmp eax, 0x26
jne 0x180022b40
mov rax, qword [rsp + 0x20]
mov byte [rax], 0x41
jmp 0x180022b83
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
cmp eax, 0x22
jne 0x180022b57
mov rax, qword [rsp + 0x20]
mov byte [rax], 0x51
jmp 0x180022b83
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
cmp eax, 0x3e
jne 0x180022b6e
mov rax, qword [rsp + 0x20]
mov byte [rax], 0x47
jmp 0x180022b83
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
cmp eax, 0x3c
jne 0x180022b83
mov rax, qword [rsp + 0x20]
mov byte [rax], 0x4c
jmp 0x180022ab7
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.180005860
add rsp, 0x168
ret

Function at 0x180023080
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
movsx eax, byte [0x180159520]
test eax, eax
jne 0x1800230dd
mov r9d, 1
mov r8d, 0x23
lea rdx, [0x180159520]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jl 0x1800230dd
lea rcx, [0x180159520]
call fcn.18000acf0
lea rcx, [0x180159520]
add rcx, rax
mov rax, rcx
lea r8, str.Reprise
lea rdx, [0x180139f2c]
mov rcx, rax
call fcn.1800f9dc0
lea rax, [0x180159520]
add rsp, 0x28
ret
Function at 0x1800233f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.18000abd0
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rsp + 0xac], 1
xor eax, eax
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rsp + 0x68], eax
mov edx, 0x2710
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x68], 0
jne 0x1800234b0
mov dword [rsp + 0x68], 0xffffffff
mov eax, dword [rsp + 0x68]
add rsp, 0xe8
ret
Function at 0x180030e00
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x38
cmp dword [0x1801596c0], 0
jne 0x180030e32
lea rcx, str.RLM_DUMP_INTERNAL_ERRORS
call fcn.180010c90
mov qword [0x1801596c8], rax
mov dword [0x1801596c0], 1
cmp qword [0x1801596c8], 0
je 0x180030ec4
call fcn.180010dc4
add rax, 0x60
mov r8d, dword [rsp + 0x40]
lea rdx, str.Internal_error:__d_n
mov rcx, rax
call fcn.1800f9fc8
cmp dword [rsp + 0x48], 0
je 0x180030eac
xor eax, eax
cmp eax, 1
je 0x180030eac
call fcn.180044fe0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x180030e7d
jmp 0x180030eac
xor edx, edx
mov ecx, dword [rsp + 0x20]
call fcn.180044fa0
mov qword [rsp + 0x28], rax
call fcn.180010dc4
add rax, 0x60
mov r8, qword [rsp + 0x28]
lea rdx, [0x18013b0b8]
mov rcx, rax
call fcn.1800f9fc8
jmp 0x180030e64
call fcn.180010dc4
add rax, 0x60
lea rdx, str.____n
mov rcx, rax
call fcn.1800f9fc8
add rsp, 0x38
ret
Function at 0x18003e860
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov rax, qword [0x180135070]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x68], 0x44
mov dword [rsp + 0x64], 0x10000000
mov dword [rsp + 0xe8], 3
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x90]
xor edx, edx
mov ecx, 1
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov eax, dword [rsp + 0x68]
add rax, 0x10
mov dword [rsp + 0x30], eax
mov edx, dword [rsp + 0x30]
xor ecx, ecx
call fcn.180024600
mov qword [rsp + 0xe0], rax
mov r8d, 2
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x64]
mov r8d, dword [rsp + 0xe8]
mov edx, 2
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAceEx]
mov edx, 1
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
mov r8, qword [rsp + 0xe0]
mov edx, 1
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0xe0]
call fcn.180024680
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.180005860
add rsp, 0x108
ret
Function at 0x18003ed70
Capabilities:
Resolve dns

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000abd0
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x30], 1
lea r9, [0x180159748]
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x18003edca
jmp 0x18003edd1
mov eax, 2
jmp 0x18003ede1
mov edx, dword [rsp + 0x80]
mov ecx, dword [rsp + 0x70]
call fcn.18003ecc0
add rsp, 0x68
ret