joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b043290
Capabilities:
Query environment variable

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
mov r12, rcx
mov ebx, edx
call fcn.6b06b650
test al, al
je 0x6b0433b0
pxor xmm6, xmm6
pxor xmm8, xmm8
pxor xmm7, xmm7
cmp bl, 1
sbb ecx, ecx
and ecx, 5
add ecx, 2
call sub.OPENGL32.dll_glBegin
mov rcx, r12
call fcn.6b06b5f0
mov rcx, r12
mov esi, dword [rax]
call fcn.6b06b600
mov rcx, r12
mov ebx, dword [rax]
cvtsi2sd xmm8, esi
call fcn.6b06b730
mov rcx, r12
cvtsi2sd xmm6, ebx
mov edi, dword [rax]
call fcn.6b06b780
pxor xmm1, xmm1
movups xmm0, xmm1
add esi, edi
mov r12d, dword [rax]
call sub.OPENGL32.dll_glTexCoord2f
cvtsi2sd xmm7, esi
movupd xmm0, xmm8
movupd xmm1, xmm6
add ebx, r12d
call sub.OPENGL32.dll_glVertex2d
movss xmm0, dword [0x6b0ba7a4]
pxor xmm1, xmm1
call sub.OPENGL32.dll_glTexCoord2f
movupd xmm1, xmm6
pxor xmm6, xmm6
movupd xmm0, xmm7
call sub.OPENGL32.dll_glVertex2d
cvtsi2sd xmm6, ebx
movss xmm1, dword [0x6b0ba7a4]
movups xmm0, xmm1
call sub.OPENGL32.dll_glTexCoord2f
movupd xmm0, xmm7
movupd xmm1, xmm6
call sub.OPENGL32.dll_glVertex2d
movss xmm1, dword [0x6b0ba7a4]
pxor xmm0, xmm0
call sub.OPENGL32.dll_glTexCoord2f
movupd xmm1, xmm6
movupd xmm0, xmm8
call sub.OPENGL32.dll_glVertex2d
nop
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp fcn.6b0014b8
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
mov r9d, 0x119
lea r8, str._home_runner_work_trnr_plugins_trnr_plugins_lib_dpf_dgl_src_OpenGL.cpp
movups xmm8, xmmword [rsp + 0x40]
lea rdx, str.rect.isValid__
lea rcx, [0x6b0ba510]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp fcn.6b019280
Function at 0x6b0631f0
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
je 0x6b063210
cmp byte [rcx + 0x10], 0
jne 0x6b063200
ret
mov rcx, r8
jmp fcn.6b013a08
mov r9d, 0xf2
lea r8, str._home_runner_work_trnr_plugins_trnr_plugins_lib_dpf_distrho_src_.._extra_String.hpp
lea rdx, [0x6b0b73c4]
lea rcx, [0x6b0b70f0]
jmp fcn.6b0189e0
Function at 0x140001a3f
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0x24], 0
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x18]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x140001b9b
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
lea rcx, [rdx + rax]
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x18
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
lea rdx, [0x1401151b0]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140001b97
mov rax, qword [0x140143038]
mov rdx, qword [rbp - 0x20]
mov edx, dword [rdx + 8]
mov r10d, edx
mov rdx, qword [rbp - 0x20]
mov edx, dword [rdx + 0xc]
mov ecx, edx
mov rdx, qword [rbp + 0x10]
add rdx, rcx
mov rcx, rdx
lea rdx, [rbp - 0x24]
mov r9, rdx
mov r8d, 0x40
mov rdx, r10
call rax
mov eax, dword [rbp - 0x24]
test eax, eax
jne 0x140001b13
mov eax, 0xffffffff
jmp 0x140001bb4
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 8]
mov r8d, eax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x18]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xc]
mov ecx, eax
mov rax, qword [rbp + 0x10]
add rax, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [0x140143038]
mov ecx, dword [rbp - 0x24]
mov rdx, qword [rbp - 0x20]
mov edx, dword [rdx + 8]
mov r11d, edx
mov rdx, qword [rbp - 0x20]
mov edx, dword [rdx + 0xc]
mov r8d, edx
mov rdx, qword [rbp + 0x10]
add rdx, r8
mov r10, rdx
lea rdx, [rbp - 0x24]
mov r9, rdx
mov r8d, ecx
mov rdx, r11
mov rcx, r10
call rax
mov eax, dword [rbp - 0x24]
test eax, eax
jne 0x140001b90
mov eax, 0xffffffff
jmp 0x140001bb4
mov eax, 0
jmp 0x140001bb4
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 4], eax
jl 0x140001a7f
mov eax, 0xffffffff
add rsp, 0x50
pop rbp
ret

Function at 0x1400020c8
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400020f4
mov eax, 0
jmp 0x14000213c
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000211d
mov eax, 0
jmp 0x14000213c
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rdx, rax
mov rax, qword [rbp + 0x18]
mov qword [rax], rdx
mov eax, 1
add rsp, 0x10
pop rbp
ret
Function at 0x140003656
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp - 8], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x10], 0
lea rax, str.ntdll.dll
mov rcx, rax
call fcn.140003d25
mov rcx, rax
lea rax, str.RtlCompareMemory
mov rdx, rax
call fcn.140003e58
mov qword [rbp - 0x38], rax
lea rax, str.ntdll.dll
mov rcx, rax
call fcn.140003d25
mov rcx, rax
lea rax, str.strcmp
mov rdx, rax
call fcn.140003e58
mov qword [rbp - 0x40], rax
lea rax, str.ntdll.dll
mov rcx, rax
call fcn.1400035aa
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
add rax, 0xc8
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x68]
mov rax, qword [rax + 0x10]
and rax, 0xfffffffffffffff8
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x68]
mov rax, qword [rax + 0x10]
cmp rax, 7
ja 0x1400036e4
mov rax, qword [rbp - 0x68]
movzx eax, byte [rax + 0x10]
and eax, 1
test al, al
jne 0x140003853
mov dword [rbp - 0x14], 0
mov qword [rbp - 0x20], 0
mov rax, qword [rbp - 0x48]
mov rax, qword [rax + 0x30]
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rax, qword [rax + 0x30]
mov eax, dword [rax + 0x3c]
cdqe
add rax, rdx
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x50]
add rax, rdx
add rax, 0x18
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x2c], 0
jmp 0x1400037b7
mov r8, qword [rbp - 0x40]
mov rax, qword [rbp - 0x28]
mov rdx, rax
lea rax, str..data
mov rcx, rax
call r8
test eax, eax
sete al
test al, al
je 0x1400037ae
mov rax, qword [rbp - 0x48]
mov rax, qword [rax + 0x30]
mov rdx, rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0xc]
mov eax, eax
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 8]
mov dword [rbp - 0x14], eax
jmp 0x1400037c7
add qword [rbp - 0x28], 0x28
add dword [rbp - 0x2c], 1
mov rax, qword [rbp - 0x50]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0x2c], eax
jl 0x140003766
mov dword [rbp - 0x30], 0
jmp 0x140003806
mov r9, qword [rbp - 0x38]
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x68]
mov r8d, 8
mov rcx, rax
call r9
mov qword [rbp - 0x58], rax
cmp qword [rbp - 0x58], 8
jne 0x1400037fd
mov rax, qword [rbp - 0x20]
mov qword [rbp - 8], rax
jmp 0x140003815
add qword [rbp - 0x20], 1
add dword [rbp - 0x30], 1
mov edx, dword [rbp - 0x30]
mov eax, dword [rbp - 0x14]
sub rax, 8
cmp rdx, rax
jb 0x1400037d0
cmp qword [rbp - 8], 0
jne 0x140003823
mov eax, 0
jmp 0x140003857
mov rax, qword [rbp - 8]
mov qword [rbp - 0x60], rax
cmp qword [rbp - 0x60], 0
je 0x140003853
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
test rax, rax
je 0x140003853
mov rax, qword [rbp - 0x60]
mov rax, qword [rax + 8]
test rax, rax
je 0x140003853
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
add rsp, 0x90
pop rbp
ret
Function at 0x14000e9d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140019390
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140019390
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x14000ea40
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1401430c4]
mov rbx, rcx
test esi, esi
jle 0x14000eb70
mov rax, qword [0x1401430c8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000ea8b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000eb15
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000ea70
mov rcx, rbx
call fcn.14000f4b0
mov rdi, rax
test rax, rax
je 0x14000eb92
mov rax, qword [0x1401430c8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000f5f0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401430c8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000eb77
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000eb0e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14000eb20
add dword [0x1401430c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1401430c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000eb0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000e9d0
nop dword [rax]
xor esi, esi
jmp 0x14000ea98
mov rax, qword [0x1401430c8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000e9d0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000e9d0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000f120
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140143120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140143100]
test rbx, rbx
je 0x14000f17c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000f173
test eax, eax
jne 0x14000f173
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000f158
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000f4b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14011bca0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000f4d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000f4d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000f4d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000f52d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000f524
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000f4d0
add rax, 0x28
cmp rax, r9
jne 0x14000f510
xor eax, eax
ret

Function at 0x14000f530
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14011bca0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000f54f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000f558
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000f54f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000f5f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14011bca0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000f60f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000f618
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14007c860
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14007c8a8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14007c87a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400b71a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140114060]
jmp 0x140010310

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000a008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000a008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000a008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x180001060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x88]
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x48]
cmp eax, dword [rcx + 0x18]
jae 0x180001164
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rax + rcx*4]
add rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.180016690
cmp eax, 0
jne 0x18000114f
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x2c]
movzx edx, word [rdx + r8*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x70], rax
jmp 0x18000116d
jmp 0x180001154
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x2c], eax
jmp 0x1800010ed
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x180001180
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
sub rsp, 0x498
mov rax, qword [0x180046380]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x60], rcx
mov rax, qword gs:[0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x20
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x280]
xor edx, edx
mov r8d, 0x208
call fcn.180011060
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x208
call fcn.180011060
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x48]
je 0x1800012bf
mov rax, qword [rsp + 0x38]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x280]
xor edx, edx
mov r8d, 0x208
call fcn.180011060
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x208
call fcn.180011060
mov rax, qword [rsp + 0x30]
mov r8, qword [rax + 0x50]
lea rcx, [rsp + 0x280]
mov edx, 0x104
call fcn.1800166f8
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.1800166f8
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x70]
call fcn.180001000
cmp eax, 0
je 0x1800012a8
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x68], rax
jmp 0x1800012c8
jmp 0x1800012ad
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
jmp 0x180001206
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18000cf80
mov rax, qword [rsp + 0x28]
add rsp, 0x498
ret
Function at 0x1800012f0
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x128
mov rax, qword [0x180046380]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x78]
call fcn.180001460
mov rcx, rax
call fcn.180002b90
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x70]
call fcn.180001550
mov rcx, rax
call fcn.180002bc0
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x68]
call fcn.180001640
mov rcx, rax
call fcn.180002bc0
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x60]
call fcn.180001730
mov rcx, rax
call fcn.180002b90
mov qword [rsp + 0x108], rax
lea rcx, [rsp + 0x58]
call fcn.180001820
mov rcx, rax
call fcn.180002b90
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x54], 0x64
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x54]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
add rax, 0x28
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
cmp rax, qword [rsp + 0x38]
je 0x180001425
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.180016690
cmp eax, 0
jne 0x18000140d
mov byte [rsp + 0x53], 1
jmp 0x18000142a
jmp 0x180001412
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x40], rax
jmp 0x1800013cb
mov byte [rsp + 0x53], 0
mov al, byte [rsp + 0x53]
and al, 1
movzx eax, al
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.18000cf80
mov eax, dword [rsp + 0x2c]
add rsp, 0x128
ret

Function at 0x180001910
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180046380]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], 0x40
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea rcx, [rsp + 0x30]
call rax
movaps xmm1, xmmword [0x180032440]
movq xmm0, qword [rsp + 0x38]
punpckldq xmm0, xmm1
movapd xmm1, xmmword [0x180032450]
subpd xmm0, xmm1
movaps xmm1, xmm0
unpckhpd xmm0, xmm0
addsd xmm0, xmm1
movsd xmm1, qword [0x180032438]
divsd xmm0, xmm1
movsd qword [rsp + 0x28], xmm0
movsd xmm0, qword [0x180032430]
ucomisd xmm0, qword [rsp + 0x28]
seta al
and al, 1
movzx eax, al
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18000cf80
mov eax, dword [rsp + 0x24]
add rsp, 0x78
ret
Function at 0x1800019b0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180046380]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x30], 0
xor eax, eax
mov ecx, eax
xor edx, edx
mov r8d, 1
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
cmp eax, 0
je 0x180001a41
lea rcx, [0x180047900]
lea rdx, [0x180032488]
call fcn.180002bf0
mov rcx, rax
mov edx, dword [rsp + 0x3c]
call fcn.180002f20
mov rcx, rax
lea rdx, [0x180003100]
call fcn.1800030e0
cmp dword [rsp + 0x3c], 0x82
setbe al
and al, 1
mov byte [rsp + 0x2f], al
jmp 0x180001a68
lea rcx, [0x180047a30]
lea rdx, str.Error_enumerating_processes.
call fcn.180002bf0
mov rcx, rax
lea rdx, [0x180003100]
call fcn.1800030e0
mov byte [rsp + 0x2f], 1
mov al, byte [rsp + 0x2f]
and al, 1
movzx eax, al
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000cf80
mov eax, dword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x180004c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov qword [rsp], 0
mov rax, qword [rsp]
cmp rax, qword [rsp + 0x10]
jae 0x180004cbc
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp]
and rcx, 7
shl rcx, 3
shr rax, cl
and rax, 0xff
movsx r8d, al
mov rax, qword [rsp + 8]
mov rcx, qword [rsp]
movsx edx, byte [rax + rcx]
xor edx, r8d
mov byte [rax + rcx], dl
mov rax, qword [rsp]
add rax, 1
mov qword [rsp], rax
jmp 0x180004c6b
add rsp, 0x20
ret
Function at 0x14071a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14071a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14071a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071a06f
add dl, dl
jne 0x14071a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071a0f6
xor eax, eax
add dl, dl
jne 0x14071a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071a1ad
add dl, dl
jne 0x14071a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14071a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14071a07e
mov eax, 1
add dl, dl
jne 0x14071a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071a0fb
sub eax, ebx
mov ebx, 1
jne 0x14071a14c
mov ecx, 1
add dl, dl
jne 0x14071a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14071a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071a15d
cmp eax, 0x7d00
jae 0x14071a19b
cmp eax, 0x500
jb 0x14071a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071a07e
cmp eax, 0x7f
ja 0x14071a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14071a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14071a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20