joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd2c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
sub rsp, 0x288
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rcx
mov dword [rsp + 0x48], 0
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4dd408
mov edx, 7
mov qword [rsp + 0x40], rdx
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov word [rsp + 0x28], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
jbe 0x4dd365
call fcn.0053cc80
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
cmp rdx, rbx
jae 0x4dd37e
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.005118a0
mov rdx, qword [rsp + 0x40]
jmp 0x4dd39c
test rbx, rbx
jne 0x4dd39c
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, qword [rsp + 0x28]
mov word [rax], bx
jmp 0x4dd3e0
test rbx, rbx
je 0x4dd3e0
lea rcx, [rsp + 0x28]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x28]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x60]
call fcn.00568a50
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rax, qword [rsp + 0x28]
mov word [rdi + rax], 0
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.004871c0
nop
cmp qword [rsp + 0x40], 8
jb 0x4dd403
mov rcx, qword [rsp + 0x28]
call fcn.00568830
mov rax, rsi
jmp 0x4dd41b
call fcn.00482e80
mov rdx, rax
mov rcx, rsi
call fcn.00481e10
mov rax, rsi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.00568fb0
mov rbx, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
add rsp, 0x288
ret
Function at 0x4e5470
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov rbp, rcx
mov qword [rax - 0x60], 7
xor ebx, ebx
mov qword [rax - 0x68], rbx
mov word [rax - 0x78], bx
lea r9d, [rbx + 4]
lea r8, [0x005d1ec0]
lea edx, [rbx + 0xe]
lea rcx, [rax - 0x78]
call fcn.00568a50
mov qword [rsp + 0x40], 2
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax + 4], bx
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
cmp qword [rbp + 0x20], 8
jb 0x4e5504
mov rdx, qword [rbp + 8]
jmp 0x4e5508
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x50]
call fcn.00571a00
test eax, eax
jne 0x4e5520
mov rdi, qword [rsp + 0x50]
test rdi, rdi
jne 0x4e5523
mov rdi, rbx
cmp qword [rsp + 0x48], 8
jb 0x4e5535
mov rcx, qword [rsp + 0x30]
call fcn.00568830
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
test rdi, rdi
je 0x4e564a
mov r8, rdi
lea rdx, [fcn.0056f110]
lea rcx, [rsp + 0x60]
call fcn.004e5450
nop
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rdi
call fcn.00572220
mov rcx, rdi
call fcn.005720b0
movsxd r12, eax
test eax, eax
jne 0x4e5594
lea rcx, [rsp + 0x60]
call fcn.004e53d0
mov al, 1
jmp 0x4e564c
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.00572220
mov byte [rsp + 0x20], 0
lea rdx, [r12 + 1]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call fcn.0041e050
nop
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x4e55db
mov rax, rsi
sub rax, rbx
jne 0x4e55e0
call fcn.0056a700
mov r9, rdi
mov r8, r12
mov edx, 1
mov rcx, rbx
call fcn.00571e50
cmp rax, r12
jne 0x4e5632
test rbx, rbx
je 0x4e5602
sub rsi, rbx
jne 0x4e5607
call fcn.0056a700
mov rdx, rbp
mov rcx, rbx
call fcn.00515520
movzx edi, al
test rbx, rbx
je 0x4e5623
mov rcx, rbx
call fcn.00568830
nop
lea rcx, [rsp + 0x60]
call fcn.004e53d0
mov al, dil
jmp 0x4e564c
test rbx, rbx
je 0x4e5640
mov rcx, rbx
call fcn.00568830
nop
lea rcx, [rsp + 0x60]
call fcn.004e53d0
xor al, al
mov rbx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xa0]
add rsp, 0xa8
ret
Function at 0x4ea310
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0x88
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov rdi, rdx
mov rbx, rcx
lea rax, [0x005d6730]
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov byte [rcx + 0x18], bpl
mov qword [r11 - 0x28], 7
mov qword [r11 - 0x30], rbp
mov word [rsp + 0x48], bp
lea r9d, [rbp + 4]
lea r8, [0x005d1ec0]
lea edx, [rbp + 0xe]
lea rcx, [r11 - 0x40]
call fcn.00568a50
mov qword [rsp + 0x58], 2
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rax, qword [rsp + 0x48]
mov word [rax + 4], bp
mov qword [rsp + 0x98], rbp
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
cmp qword [rdi + 0x20], 8
jb 0x4ea3c2
mov rdx, qword [rdi + 8]
jmp 0x4ea3c6
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x98]
call fcn.00571a00
test eax, eax
jne 0x4ea3e4
mov rdi, qword [rsp + 0x98]
test rdi, rdi
jne 0x4ea3e7
mov rdi, rbp
cmp qword [rsp + 0x60], 8
jb 0x4ea3f9
mov rcx, qword [rsp + 0x48]
call fcn.00568830
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbp
mov word [rsp + 0x48], bp
test rdi, rdi
je 0x4ea4ca
mov r8, rdi
lea rdx, [fcn.0056f110]
lea rcx, [rsp + 0x28]
call fcn.004e5450
nop
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rdi
call fcn.00572220
mov rcx, rdi
call fcn.005720b0
movsxd rcx, eax
mov qword [rbx + 0x10], rcx
test cl, 1
je 0x4ea45c
lea rcx, [rsp + 0x28]
call fcn.004e53d0
nop
mov rax, rbx
jmp 0x4ea4cd
shr rcx, 1
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.0053ce20
mov rsi, rax
mov qword [rbx + 8], rax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.00572220
mov r9, rdi
mov r8, qword [rbx + 0x10]
mov edx, 1
mov rcx, rsi
call fcn.00571e50
cmp rax, qword [rbx + 0x10]
jne 0x4ea4ae
mov byte [rbx + 0x18], 1
jmp 0x4ea4ba
mov rcx, rsi
call fcn.005688d0
mov qword [rbx + 8], rbp
lea rcx, [rsp + 0x28]
call fcn.004e53d0
nop
mov rax, rbx
jmp 0x4ea4cd
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
add rsp, 0x88
ret

Function at 0x4ead18
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, LoadRegTypeLib
call fcn.0056a100
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], RegisterTypeLib
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4ead90
cmp dword [rsp + 0x24], 5
mov ecx, 1
ja 0x4ead73
jne 0x4ead90
cmp dword [rsp + 0x28], ecx
jb 0x4ead90
mov edx, 0x7ffe0000
mov rax, rbx
and rax, rdx
cmp rax, rdx
jne 0x4ead90
mov eax, 0x7ffe0304
and rbx, rax
cmp rbx, rax
je 0x4ead92
xor ecx, ecx
mov al, cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.00568fb0
add rsp, 0xd0
pop rbx
ret
Function at 0x4f95d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x38
test rcx, rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov rdi, rcx
mov rbx, rdx
jne 0x4f9616
call fcn.00473e00
lea rcx, str.data
lea r9, str.CrcAlgorithm1::GetCrc
mov r10, qword [rax]
mov qword [rsp + 0x20], rcx
lea r8d, [rdi + 0x5b]
lea rdx, [0x005d8060]
mov rcx, rax
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test rbx, rbx
mov r8d, 0xffffffff
je 0x4f9651
lea r9, [0x005d7c60]
nop
nop
movzx edx, byte [rdi]
movzx eax, r8b
mov ecx, r8d
xor rdx, rax
shr ecx, 8
add rdi, 1
mov r8d, dword [r9 + rdx*4]
xor r8d, ecx
sub rbx, 1
jne 0x4f9630
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
not r8d
mov eax, r8d
add rsp, 0x38
ret

Function at 0x4fa240
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea rax, [rcx + 0x9cc]
mov r9d, 1
mov dword [rcx + 0x9d0], 0
mov dword [rcx], edx
mov r10d, 0x26f
mov dword [rax], edx
mov dword [rcx + 0x9c8], r9d
nop
nop
mov edx, dword [rcx]
lea r8, [rcx + 4]
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul ecx, ecx, 0x6c078965
add ecx, r9d
add r9d, 1
sub r10, 1
mov dword [r8], ecx
mov rcx, r8
jne 0x4fa270
mov eax, dword [rax]
ret

Function at 0x4fa2a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
add dword [rcx + 0x9c8], 0xffffffff
mov r9, rcx
jne 0x4fa370
mov r8, rcx
mov edx, 0xe3
nop
nop
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [r8]
shr ecx, 1
neg al
sbb eax, eax
add r8, 4
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [r8 + 0x630]
sub edx, 1
mov dword [r8 - 4], ecx
jne 0x4fa2c0
mov r10d, 0x18c
nop
nop
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea rdx, [r8 + 4]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [r8]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [r8 - 0x38c]
sub r10d, 1
mov dword [r8], ecx
mov r8, rdx
jne 0x4fa300
mov eax, dword [r9]
mov ecx, dword [rdx]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [rdx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rdx - 0x38c]
mov dword [rdx], ecx
mov dword [r9 + 0x9c8], 0x270
mov qword [r9 + 0x9c0], r9
mov rax, qword [r9 + 0x9c0]
add dword [r9 + 0x9d0], 1
mov ecx, dword [rax]
add rax, 4
mov qword [r9 + 0x9c0], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x50adf0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jne 0x50ae57
call fcn.00473e00
mov r10, qword [rax]
lea rcx, str.count
mov qword [rsp + 0x20], rcx
lea r9, str.FileAccess::OSAccessorFile::Read
mov r8d, 0x170
lea rdx, str..OSAccessorFile.cpp
mov rcx, rax
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor eax, eax
jmp 0x50afef
mov ebp, 0xffffffff
cmp r8, rbp
jbe 0x50aec5
mov rdx, r8
lea rcx, [rsp + 0x80]
call fcn.00467910
nop
mov r9, qword [0x00640e40]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
lea r8, [rsp + 0x80]
mov edx, 0xe7d1000c
lea rcx, [rsp + 0x68]
call fcn.00465350
lea rdx, [0x0063ada0]
lea rcx, [rsp + 0x68]
call fcn.00568cd0
nop
test dword [rcx + 0x28], 0x80000000
jne 0x50aeef
mov edx, 0xe7d10004
lea rcx, [rsp + 0x68]
call fcn.00493010
lea rdx, [0x0063ada0]
lea rcx, [rsp + 0x68]
call fcn.00568cd0
int3
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rbx + 0x20]
cmp rcx, 0xffffffffffffffff
jne 0x50af1f
mov edx, 0xe7d10004
lea rcx, [rsp + 0x68]
call fcn.00493010
lea rdx, [0x0063ada0]
lea rcx, [rsp + 0x68]
call fcn.00568cd0
int3
xor eax, eax
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x50afad
lea rcx, [rsp + 0x68]
call fcn.00491070
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.004677a0
nop
mov r9, qword [0x00640e40]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
lea r8, [rsp + 0x80]
mov edx, 0xe7d1001e
lea rcx, [rsp + 0x70]
call fcn.00465350
lea rdx, [0x0063ada0]
lea rcx, [rsp + 0x70]
call fcn.00568cd0
nop
mov edi, dword [rsp + 0x60]
cmp byte [rbx + 0x2c], 0
je 0x50afec
mov r8, rdi
lea rdx, [rsp + 0x70]
lea rcx, [0x00648110]
call fcn.005225e0
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x50afec
add dword [rbx], ebp
cmp dword [rbx], 0
jne 0x50afec
mov rcx, rbx
call fcn.0045f110
mov rcx, rbx
call fcn.00568830
mov rax, rdi
mov rbx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xc8]
add rsp, 0xa8
ret
Function at 0x50b780
Capabilities:
Get file size

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov r12, rdx
xor ebp, ebp
mov rsi, rbp
mov rbx, rbp
mov qword [rax - 0x38], rbp
mov rcx, qword [rcx + 0x20]
cmp rcx, 0xffffffffffffffff
jne 0x50b816
mov edx, 0xe7d10004
lea rcx, [rax - 0x40]
call fcn.00493010
nop
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x50b7ec
mov rbx, rdi
add dword [rdi], 1
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x50b8e7
add dword [rdi], 0xffffffff
cmp dword [rdi], 0
jne 0x50b8e7
mov rcx, rdi
call fcn.0045f110
mov rcx, rdi
call fcn.00568830
jmp 0x50b8e7
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x50b8dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x50b8dc
lea rcx, [rsp + 0x68]
call fcn.00491070
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.004677a0
nop
mov r9, qword [0x00640e40]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
lea r8, [rsp + 0x88]
mov edx, 0x67d1004b
lea rcx, [rsp + 0x78]
call fcn.00465350
nop
mov rcx, qword [rax]
test rcx, rcx
je 0x50b8aa
mov rbx, rcx
add dword [rcx], 1
mov qword [rsp + 0x70], rcx
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x50b8cd
add dword [rdi], 0xffffffff
cmp dword [rdi], 0
jne 0x50b8cd
mov rcx, rdi
call fcn.0045f110
mov rcx, rdi
call fcn.00568830
nop
lea rcx, [rsp + 0x88]
call fcn.004679c0
jmp 0x50b8e7
mov esi, dword [rsp + 0x60]
shl rsi, 0x20
add rsi, rdi
test r12, r12
je 0x50b91e
mov rdi, qword [r12]
cmp rdi, rbx
je 0x50b91e
test rdi, rdi
je 0x50b90f
add dword [rdi], 0xffffffff
jne 0x50b90f
mov rcx, rdi
call fcn.0045f110
mov rcx, rdi
call fcn.00568830
test rbx, rbx
je 0x50b91a
add dword [rbx], 1
mov rbp, rbx
mov qword [r12], rbp
test rbx, rbx
je 0x50b942
add dword [rbx], 0xffffffff
jne 0x50b93d
mov rcx, rbx
call fcn.0045f110
mov rcx, rbx
call fcn.00568830
mov rax, rsi
jmp 0x50b945
mov rax, rsi
jmp 0x50b945
mov rax, rsi
mov rbx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xa0]
add rsp, 0xa8
ret
Function at 0x50db10
Capabilities:
Enumerate network shares

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rdi
mov qword [rax - 0x10], r13
mov eax, dword [rcx + 0x18]
mov rbp, rdx
cmp dword [rcx + 0x14], eax
mov rbx, rcx
jae 0x50db80
mov dword [rdx], reloc.OLEAUT32.dll_SafeArrayGetDim
mov eax, dword [rcx + 0x14]
mov r8, qword [rcx + 8]
lea r10, [rax + rax*2]
lea rcx, [rdx + 0x28]
mov r9, 0xffffffffffffffff
add r10, r10
mov edx, 0x104
mov r8, qword [r8 + r10*8 + 0x18]
call fcn.00568da0
xor edi, edi
mov al, 1
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x18], rdi
add dword [rbx + 0x14], 1
jmp 0x50dcf5
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
movabs r15, 0xaaaaaaaaaaaaaaab
mov qword [rsp + 0x80], rsi
mov r13, 0xffffffffffffffff
lea r14, str.mNetResource
nop
mov r8, qword [rbx + 8]
mov rcx, qword [rbx]
lea r9, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0xffffffff
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
mov esi, eax
je 0x50dc99
cmp eax, 0xea
jne 0x50dc7d
mov rcx, qword [rbx + 8]
call fcn.005688d0
mov ecx, dword [rbx + 0x10]
mov r11d, dword [rbx + 0x10]
mov rax, r15
mul r11
mov rax, r15
mov rdi, rdx
mul rcx
shr rdi, 5
shr rdx, 5
lea rax, [rdx + rdx*2]
shl rax, 4
cmp rcx, rax
je 0x50dc19
add edi, 1
lea ecx, [rdi + rdi]
mov eax, 0x30
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.0053ce20
test rax, rax
mov qword [rbx + 8], rax
jne 0x50dc61
call fcn.00473e00
lea r9, str.FileAccess::OSAccessorNet::GetNetShare
lea rdx, str..OSAccessorNet.cpp
mov r10, qword [rax]
mov r8d, 0x1d9
mov rcx, rax
mov qword [rsp + 0x20], r14
call qword [r10 + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + rdi*2]
xor edx, edx
shl r8d, 4
mov dword [rbx + 0x10], r8d
call fcn.0056a100
jmp 0x50dbb0
mov rcx, qword [rbx + 8]
call fcn.005688d0
mov rcx, qword [rbx]
xor edi, edi
mov qword [rbx + 8], rdi
call sub.MPR.dll_WNetCloseEnum
mov qword [rbx], rdi
jmp 0x50dcd9
mov dword [rbp], reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8, qword [rbx + 8]
lea rcx, [rbp + 0x28]
mov r8, qword [r8 + 0x18]
mov r9, r13
mov edx, 0x104
call fcn.00568da0
mov ecx, dword [rsp + 0x30]
xor edi, edi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x18], rdi
mov dword [rbx + 0x18], ecx
mov dword [rbx + 0x14], 1
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
test esi, esi
mov rsi, qword [rsp + 0x80]
sete al
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x512550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, rdx
mov edx, r8d
jmp 0x512550
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x78], rax
test rcx, rcx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x18], r12
mov r12, rcx
movsxd rbp, edx
je 0x5126f6
test edx, edx
jle 0x5126f6
mov qword [r11 + 0x18], rbx
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x20], r13
xor r13d, r13d
mov ebx, 0x80000002
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x24], r13d
mov dword [r11 - 0x80], r13d
mov dword [r11 - 0x7c], r13d
mov rsi, r13
lea rdi, [r11 - 0x60]
nop
nop
cmp byte [0x00643220], r13b
je 0x512622
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
mov byte [0x00643220], r13b
mov byte [0x00648024], 1
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x3c], r13d
call fcn.005232e0
mov r11d, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x80000000
mov dword [0x00648020], r11d
call fcn.005232e0
mov r11d, dword [rsp + 0x30]
mov dword [0x0064801c], r11d
cmp byte [0x00648024], r13b
je 0x512654
cmp ebx, dword [0x00648020]
jbe 0x512641
bt ebx, 0x1f
jae 0x512654
cmp ebx, dword [0x0064801c]
ja 0x512654
lea r8, [rsp + 0x20]
xor edx, edx
mov ecx, ebx
call fcn.005232e0
mov r11b, 1
jmp 0x512657
xor r11b, r11b
test r11b, r11b
mov eax, dword [rsp + 0x20]
mov dword [rdi - 8], eax
mov eax, dword [rsp + 0x24]
mov dword [rdi - 4], eax
mov eax, dword [rsp + 0x28]
mov dword [rdi], eax
mov eax, dword [rsp + 0x2c]
mov dword [rdi + 4], eax
mov byte [rdi + 8], r13b
je 0x5126f2
add rsi, 1
add ebx, 1
add rdi, 0x10
cmp rsi, 3
jl 0x5125c0
lea eax, [rbp - 1]
lea r8, [rsp + 0x40]
mov rdx, rbp
movsxd r9, eax
mov rcx, r12
call fcn.0056ef40
mov byte [rbp + r12 - 1], r13b
mov al, 1
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xc0]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.00568fb0
add rsp, 0xa8
ret
xor al, al
jmp 0x5126ad
xor al, al
jmp 0x5126cd

Function at 0x517b5c
Capabilities:
Check for sandbox and av modules

Disassembly:
push rbx
push rdi
sub rsp, 0x38
lea rcx, str.DBGHELP.DLL
mov rdi, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, rbx
jne 0x517bab
call fcn.00473e00
lea rcx, str.NULL___hInst
lea r9, str.CSymbolEngine::GetDbgHelpAddress
mov r10, qword [rax]
mov qword [rsp + 0x20], rcx
lea rdx, str..SymbolEngine.cpp
mov r8d, 0x225
mov rcx, rax
call qword [r10 + reloc.OLEAUT32.dll_VariantClear]
jmp 0x517bba
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x533f80
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
call fcn.004e1770
mov rcx, rax
call fcn.004dc210
cmp eax, 0x10e10004
jne 0x5340c2
call fcn.004e1770
mov rcx, rax
call fcn.004dc230
cmp dword [rax], 5
jb 0x5340c2
cmp byte [0x00648249], 0
je 0x533fc9
mov al, byte [0x00648248]
add rsp, 0x20
pop rbx
ret
lea rcx, str.pdh.dll
mov byte [0x00648249], 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x533fbd
lea rdx, str.PdhOpenQueryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PdhCloseQuery
mov rcx, rbx
mov qword [0x006481f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PdhCollectQueryData
mov rcx, rbx
mov qword [0x006481f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PdhGetFormattedCounterValue
mov rcx, rbx
mov qword [0x00648208], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PdhExpandCounterPathW
mov rcx, rbx
mov qword [0x00648210], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PdhValidatePathW
mov rcx, rbx
mov qword [0x006481e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PdhAddCounterW
mov rcx, rbx
mov qword [0x006481d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PdhRemoveCounter
mov rcx, rbx
mov qword [0x006481e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PdhLookupPerfNameByIndexW
mov rcx, rbx
mov qword [0x00648200], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x006481d0], rax
mov al, 1
mov byte [0x00648248], al
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret