joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ee80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
sub rsp, 0x20
cmp qword [rcx], 0
mov ebp, r8d
mov r12, rdx
mov rbx, rcx
jne 0x18004ef60
cmp dword [rcx + 8], 0xffffffff
jne 0x18004ef60
lea rdx, [rcx + 0x250]
mov ecx, 0x104
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0x250]
repne scasw ax, word [rdi]
not rcx
movzx eax, word [rbx + rcx*2 + 0x24c]
cmp ax, 0x5c
je 0x18004ef09
cmp ax, 0x2f
je 0x18004ef09
xor eax, eax
lea rdi, [rbx + 0x250]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x180075b70]
mov dword [rdi - 2], eax
mov ecx, 0x30
call fcn.180050744
xor edi, edi
mov rcx, rax
mov byte [rax], 0
mov byte [rax + 1], 1
mov byte [rax + 0x18], 0
mov qword [rax + 0x20], r12
mov dword [rax + 0x28], ebp
mov dword [rax + 0x2c], edi
mov dword [rax + 0x14], edi
call fcn.18004db00
mov rsi, qword [rsp + 0x30]
test rax, rax
mov ecx, 0x200
cmove edi, ecx
mov qword [rbx], rax
mov eax, edi
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov eax, 0x1000000
add rsp, 0x20
pop r12
ret

Function at 0x180052c3f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180084090]
jne 0x18004f78a
rol rcx, 0x10
test cx, 0xffff
jne 0x18004f786
repz ret
ror rcx, 0x10
jmp 0x180052b98
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18009f2c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18009f3b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180052c1d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18009f2c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180052c3f
mov rax, qword [rsp + 0x88]
mov qword [0x18009f3b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18009f358], rax
mov rax, qword [0x18009f3b8]
mov qword [0x18009f230], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18009f340], rax
mov dword [0x18009f220], 0xc0000409
mov dword [0x18009f224], 1
mov rax, qword [0x180084090]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180084098]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18009f2b8], eax
mov ecx, 1
call fcn.1800549a4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180069ad8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18009f2b8], 0
jne 0x180052cc6
mov ecx, 1
call fcn.1800549a4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180053168
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180052fdc

Function at 0x18005d140
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180054510
xor ebx, ebx
mov rdi, rax
cmp qword [0x18009ffe8], rbx
jne 0x18005d246
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18005d31b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005d31b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18009ffe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18009fff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18009fff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1800a0008], rax
test rax, rax
je 0x18005d23d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1800a0000], rax
jmp 0x18005d24d
mov rax, qword [0x1800a0000]
jmp 0x18005d254
mov rax, qword [0x1800a0000]
mov r11, qword [0x1800a0008]
cmp rax, rdi
je 0x18005d2bc
cmp r11, rdi
je 0x18005d2bc
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1800a0008]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18005d2bc
test rax, rax
je 0x18005d2bc
call rsi
test rax, rax
je 0x18005d2b6
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18005d2b6
test byte [rsp + 0x38], 1
jne 0x18005d2bc
bts ebp, 0x15
jmp 0x18005d2fa
mov rcx, qword [0x18009fff0]
cmp rcx, rdi
je 0x18005d2fa
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18005d2fa
call rax
mov rbx, rax
test rax, rax
je 0x18005d2fa
mov rcx, qword [0x18009fff8]
cmp rcx, rdi
je 0x18005d2fa
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18005d2fa
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18009ffe8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18005d31b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18005d31d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800f4239
Capabilities:
Acquire debug privileges

Disassembly:
cmp qword [rsp + 0x80], 0
jmp 0x1800dd252
jmp 0x1800c1664
jne 0x1800f152d
test ah, ah
cmc
clc
sub eax, eax
jmp 0x1800f6746
jne 0x1800d4a35
cmc
cmc
xor eax, eax
jmp 0x1800f6746
mov cx, si
mov dword [rsp + 0x58], 0
movsx ecx, al
movzx cx, cl
lea rcx, [0x180070e70]
jmp 0x18001be5c
jmp 0x1800e6975
jbe 0x1800ef2af
je 0x1800c166a
test al, 0xee
cmp qword [rsp + 0x80], 0
jmp 0x1800bc997
jne 0x1800f152d
cmc
stc
cmc
xor eax, eax
jmp 0x1800f6746
je 0x1800c2163
cmp dx, dx
cmc
test cx, sp
cmp qword [rsp + 0x70], 0xffffffffffffffff
jmp 0x1801088c7
jmp 0x1800fb4f6
test dl, 0x7c
cmp ch, 0x52
bt dx, 0xe
cmp qword [rsp + 0x70], 0
jmp 0x1800ea68e
stc
jmp 0x1800bab58
cmp ah, al
clc
bt eax, 0x15
mov dword [rsp + 0x20], r9d
stc
bt cx, 0xd
test dh, 0x3b
cmp dl, 0x23
mov qword [rsp + 0x18], r8
cmc
clc
stc
mov qword [rsp + 0x10], rdx
bt edx, esp
bt ax, ax
mov qword [rsp + 8], rcx
test cl, 0x74
clc
sub rsp, 0x68
stc
cmp qword [rsp + 0x78], 0
jmp 0x1800e38fc
stc
cmp bl, cl
clc
bt dx, 0xe
add rsp, 0x68
ret
je 0x1800c166a
stc
jmp 0x1800f37a9
jmp 0x1800c215d
Function at 0x180103835
Capabilities:
Check if file exists
Get file size
Get hostname
Read file on windows

Disassembly:
jmp 0x1800f7af8
jmp 0x1800beebf
bswap cx
mov ecx, dword [rsp + 0x44]
jmp 0x1800ae837
call fcn.180001df0
bswap ecx
lea r8, [rax*2 - 0x3a26013d]
not cx
mov r8d, 0x104
setge cl
mov dx, dx
lea rcx, [rdi - 0x5ec7dbce]
jmp 0x1800d45ce
jmp loc.18001baf8
mov rdx, rax
lea rcx, [rcx*2 + 0x76ef2579]
mov ecx, dword [rsp + 0x44]
jmp loc.18001c2c2
movsx eax, al
mov eax, dword [rsp + 0x200]
movzx cx, cl
mov dword [rsp + 0x44], eax
mov ecx, esi
jmp 0x1800f266d
call fcn.180001700
xchg dh, ch
nop
bswap edx
mov edx, 0x104
mov ch, bh
not cx
mov cx, 0x30bf
lea rcx, [rsp + 0x50]
jp 0x1800b442b
call fcn.180001df0
mov dh, dl
lea rcx, [rsi + 0x22d8e8a9]
movsx rcx, al
mov r8d, 0x104
xchg ch, dh
jmp 0x1800ed8d4
not dl
setnp ch
mov rdx, rax
bswap ecx
jmp 0x1800b8d48
bswap cx
lea rcx, [rsp + 0x50]
jmp 0x1800e6297
call fcn.18000aab0
movsx dx, al
setl ch
bswap rcx
mov edx, 0xffffffff
lea rcx, [rcx - 0x7423cb46]
lea rcx, [rsp + 0x50]
jmp 0x1800d3f63
movsx ax, cl
bsf eax, esp
mov qword [rsp + 8], rcx
bts ecx, 3
sub rsp, 0x1f8
setle ch
mov qword [rsp + 0x170], 0xfffffffffffffffe
movsx cx, dl
bswap cx
setl ah
mov dword [rsp + 0x168], 0
movsx eax, al
jmp 0x1800de34d
Function at 0x140008de0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x140008ea3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x140008e14
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140008ea6
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x140008e5f
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140008e63
test rax, rax
je 0x140008ea3
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140008e94
cmp rdx, rax
jb 0x140008e80
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000aaa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x14000acca
xor edx, edx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], dx
jne 0x14000aac6
test rax, rax
je 0x14000ab04
xor ecx, ecx
nop word [rax + rax]
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x14000acca
cmp r8w, 0x2f
je 0x14000acca
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x14000aae0
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.14000acf0
mov rsi, rax
test rax, rax
je 0x14000abf5
mov qword [rsp + 0x50], r14
call fcn.14000b4b0
mov r14, rax
test rax, rax
je 0x14000abe2
mov rcx, rsi
call fcn.140008c40
test eax, eax
je 0x14000abcb
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x14000ab77
mov r8, rbx
mov rcx, rsi
call fcn.140015180
test eax, eax
je 0x14000ab9f
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x14000ab70
jmp 0x14000abae
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.14000a4a0
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x14000abd9
mov rcx, rsi
call fcn.140008be0
test eax, eax
je 0x14000abd9
mov rbp, rsi
xor esi, esi
jmp 0x14000abd9
mov rdx, rsi
mov rcx, r14
call fcn.14000a4a0
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x14000ac96
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x14000ac9f
mov rcx, rbx
call fcn.140008ac0
mov rdi, rax
test rax, rax
je 0x14000ac9f
mov ecx, 0x37e4
call fcn.14000a0a0
test eax, eax
je 0x14000ac34
lea rcx, [0x14002b830]
call fcn.14000b1e0
jmp 0x14000ac39
call fcn.14000b4b0
mov rbx, rax
test rax, rax
je 0x14000ac8d
mov rdx, rdi
mov rcx, rax
call fcn.14000a4a0
mov rbp, rax
test rax, rax
je 0x14000ac84
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000ac66
test al, 0x50
je 0x14000ac84
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14000ac79
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x14000ac9f
xor ecx, ecx
jmp 0x14000acac
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000acb2
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x14000b4b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000b512
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000b507
cmp edi, eax
jb 0x14000b507
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14004d870
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14004d87d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14004d88d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14004d875
lea eax, [rcx + 1]
jmp 0x14004d89b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14004d8ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14004d894
sub eax, 3
jb 0x14004d8ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14004d91d
sar eax, 1
movsxd rbp, eax
jb 0x14004d904
jmp 0x14004d8dc
add ebx, ebx
jne 0x14004d8da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14004d904
inc ecx
add ebx, ebx
jne 0x14004d8ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14004d904
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14004d8fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14004d8ec
add ecx, 2
jmp 0x14004d909
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14004d832
jmp 0x14004d87d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x29e00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14004d969
cmp rsi, rcx
jae 0x14004d971
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14004d950
cmp al, 0x8f
ja 0x14004d950
cmp byte [rsi - 2], 0xf
je 0x14004d956
sub al, 0xe8
cmp al, 1
ja 0x14004d93a
cmp rsi, rcx
jae 0x14004d971
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14004d940
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14004d971
lodsb al, byte [rsi]
jmp 0x14004d950
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x4b000]
mov eax, dword [rdi]
or eax, eax
je 0x14004d9da
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x51294]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14004d97e
jns 0x14004d9b3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14004d9bd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14004d9d4
mov qword [rbx], rax
add rbx, 8
jmp 0x14004d99e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14004da14
cmp al, 0xef
ja 0x14004da06
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14004d9e6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14004d9f5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14004da68
sub rsp, 0xffffffffffffff80
jmp 0x14000c1f0
Function at 0x140002230
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov ebp, r8d
mov esi, edx
mov rbx, rcx
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.RemoveTasks
mov r8, r14
mov r9d, ebp
call fcn.1400035b0
movsxd r15, eax
lea r12, [r15*2 + 2]
inc r15
mov rcx, r12
call fcn.140002490
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
mov rcx, rdi
mov rdx, r15
call fcn.140003630
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400022fc
mov rbx, rax
lea rax, [rsp + 0x50]
mov qword [rax], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140002488
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003110
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180003530
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180003556
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.180003530
movzx edx, word [rdi + rbx*2]
mov ecx, eax
mov rbx, qword [rsp + 0x30]
xor rdx, rcx
movzx ecx, dl
lea rdx, [0x18002c740]
shr eax, 8
xor eax, dword [rdx + rcx*4]
add rsp, 0x20
pop rdi
ret

Function at 0x1800035b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1800035d6
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
dec rcx
mov qword [rsp + 0x38], rdi
call fcn.1800035b0
movsx ebx, byte [rbx + rsi]
mov edi, eax
call fcn.180003590
mov byte [rsp + 0x30], al
movzx edx, bl
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x40], 0x14827984
mov r8d, dword [rsp + 0x40]
movzx ecx, byte [rsp + 0x30]
xor r8d, 0x5c4
movsx eax, byte [rsp + 0x30]
sub dl, cl
xor r8b, 0x5a
cmp dl, r8b
mov edx, ebx
mov rbx, qword [rsp + 0x48]
sbb ecx, ecx
add eax, 0xbe
and ecx, 0x20
or edx, ecx
lea rcx, [0x18002c740]
xor edx, edi
shr edi, 8
and rax, rdx
xor edi, dword [rcx + rax*4]
mov eax, edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x180003660
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180003686
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
dec rcx
mov qword [rsp + 0x38], rdi
call fcn.180003660
movzx ebx, word [rsi + rbx*2]
mov edi, eax
call fcn.180003590
mov byte [rsp + 0x30], al
movzx ecx, bx
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x40], 0x3dae9931
mov r8d, dword [rsp + 0x40]
movsx edx, byte [rsp + 0x30]
xor r8d, 0x5c4
sub cx, dx
xor r8b, 0xef
movsx edx, byte [rsp + 0x30]
movzx eax, r8b
cmp cx, ax
sbb ax, ax
add edx, 0xbe
and ax, 0x20
or bx, ax
lea rax, [0x18002c740]
movzx ecx, bx
mov rbx, qword [rsp + 0x48]
xor rcx, rdi
shr edi, 8
and rdx, rcx
xor edi, dword [rax + rdx*4]
mov eax, edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1800058c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r15
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r9d, 0xf
mov dword [rbp - 0x19], 0x493f4653
mov eax, 0x4d0f
mov dword [rbp - 0x15], 0xa887dba8
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x11], 0xe13dfcb7
lea rcx, [rbp + 0x17]
mov dword [rbp - 0xd], 0x8c961d0a
lea r8d, [r9 + 0x22]
mov dword [rbp - 9], 0x933effb8
mov word [rbp - 5], ax
mov word [rsp + 0x20], 0x25
call fcn.1800056a0
lea rax, [rbp + 0x17]
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x3f], rax
mov r8, rbx
mov rsi, qword [rbp + 0x3f]
nop
inc r8
cmp word [rsi + r8*2], 0
jne 0x180005950
dec r8
lea r15, [0x18002c740]
mov edi, 0xffffffff
cmp r8, rbx
jne 0x180005973
mov eax, edi
jmp 0x180005994
lea rcx, [r8 - 1]
mov rdx, rsi
call fcn.180003530
movzx edx, word [rsi + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx r8d, dl
xor eax, dword [r15 + r8*4]
not eax
mov ecx, eax
call fcn.180006960
test rax, rax
jne 0x1800059aa
mov rcx, rsi
call fcn.180006500
mov edx, 0x1bb06e09
mov rcx, rax
call fcn.180006b00
test rax, rax
je 0x180005aad
lea r8, [rbp + 0x3f]
mov qword [rbp + 0x2f], 0
lea rdx, [rbp + 0x2f]
mov dword [rbp + 0x3f], 0
xor ecx, ecx
call rax
cmp dword [rbp + 0x3f], 3
je 0x180005aad
mov r9d, 0x43
mov dword [rbp - 1], 0x5ac53a7a
lea rdx, [rbp - 1]
mov dword [rbp + 3], 0x8dcae24e
lea rcx, [rbp - 0x19]
mov dword [rbp + 7], 0x302a2c22
mov dword [rbp + 0xb], 0x75b7f730
lea r8d, [r9 - 0x2a]
mov dword [rbp + 0xf], 0x4e939af8
mov word [rsp + 0x20], 0x30
call fcn.180005ae0
lea rax, [rbp - 0x19]
mov qword [rbp + 0x2f], rax
mov rsi, qword [rbp + 0x2f]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x180005a32
dec rbx
cmp rbx, 0xffffffffffffffff
je 0x180005a67
lea rcx, [rbx - 1]
mov rdx, rsi
call fcn.180003530
movzx edx, word [rsi + rbx*2]
mov ecx, eax
xor rdx, rcx
mov edi, eax
movzx r8d, dl
shr edi, 8
xor edi, dword [r15 + r8*4]
not edi
mov ecx, edi
call fcn.180006960
test rax, rax
jne 0x180005a7d
mov rcx, rsi
call fcn.180006500
mov edx, 0xb70a5108
mov rcx, rax
call fcn.180006b00
test rax, rax
je 0x180005aad
lea rdx, [rbp + 0x37]
mov qword [rbp + 0x37], 0
xor ecx, ecx
call rax
cmp qword [rbp + 0x37], 0
jne 0x180005aad
mov eax, 1
jmp 0x180005aaf
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180007de0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret