joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002138c
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400590d0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 0x18]
mov dword [rbp - 0x10], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x20], eax
test eax, eax
je 0x140021419
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp - 0x20], ecx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x20]
test eax, eax
setne al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002ee10
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x14002143c
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1030
call fcn.14002eda0
sub rsp, rax
mov rax, qword [0x1400590d0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rbx, rcx
mov edx, 0x800
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140021478
xor eax, eax
jmp 0x14002149b
mov r9d, 0x800
lea r8, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140015994
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14002ee10
add rsp, 0x1030
pop rbx
ret

Function at 0x1400215c8
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400590d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140021641
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
and qword [rsp + 0x28], 0
lea r8, [rsp + 0x38]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp ebx, 1
jne 0x140021654
mov edx, 0x80000000
lea ecx, [rbx + 4]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
cmp ebx, 3
jne 0x140021665
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.POWRPROF.dll_SetSuspendState
cmp ebx, 2
jne 0x140021676
xor r8d, r8d
xor edx, edx
mov cl, 1
call sub.POWRPROF.dll_SetSuspendState
cmp ebx, 4
jne 0x140021689
mov edx, 0x80000000
lea ecx, [rbx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002ee10
add rsp, 0x50
pop rbx
ret
Function at 0x140021a08
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx], edi
jbe 0x140021aaa
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140021bc0]
and dword [rsp + 0x20], 0
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x140021a80
lea rdx, str.CreateThread_failed
lea rcx, [0x140063c30]
call fcn.14000bcb0
lea rcx, [0x140063c30]
call fcn.14000bfb8
lea edx, [rsi + 2]
lea rcx, [0x140063c30]
call fcn.14000bc84
mov qword [rbx + rdi*8 + 8], rsi
inc dword [rbx + 0x208]
mov edx, dword [0x14006eed0]
test edx, edx
je 0x140021aa0
mov rcx, qword [rbx + rdi*8 + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc edi
cmp edi, dword [rbx]
jb 0x140021a24
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400366c0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140036494
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140036494
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140036494
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140036494
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140036494
cmp dword [rcx + 0x84], 0xe
jbe 0x140036494
cmp dword [rcx + 0xf8], esi
je 0x140036494
mov ecx, r14d
call fcn.1400365dc
mov ecx, 2
call fcn.14003afb8
nop
cmp byte [0x14006f900], 0
jne 0x14003655e
mov r15d, 1
mov eax, r15d
xchg dword [0x14006f8f0], eax
test ebx, ebx
jne 0x140036507
mov rdi, qword [0x1400590d0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14006f8f8]
cmp rcx, rax
je 0x1400364fe
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140030000]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14006fa68]
jmp 0x140036513
cmp ebx, r15d
jne 0x140036519
lea rcx, [0x14006fa80]
call fcn.140038a28
nop
test ebx, ebx
jne 0x140036530
lea rdx, [0x1400445a0]
lea rcx, [0x140044580]
call fcn.140038d30
lea rdx, [0x1400445b0]
lea rcx, [0x1400445a8]
call fcn.140038d30
movzx eax, byte [0x14006f900]
test esi, esi
cmove eax, r15d
mov byte [0x14006f900], al
jmp 0x14003655e
mov ecx, 2
call fcn.14003b018
test esi, esi
jne 0x140036575
mov ecx, r14d
call fcn.140036590
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140036424
Function at 0x100005160
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x100027110]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rsi, rcx
mov rdi, r8
mov rbx, rdx
xor ebp, ebp
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x9e
mov dword [rsp + 0x34], ebp
mov word [rsp + 0x40], bp
call sub.msvcrt.dll_memset
cmp rsi, rbp
je 0x10000523e
movzx eax, word [rdi + 6]
lea ecx, [rbp + 0x50]
lea rdi, [rsp + 0x40]
mov word [rsp + 0x32], ax
xor eax, eax
mov word [rsp + 0x30], bp
mov edx, dword [rsp + 0x30]
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea edi, [rbp + 0x4f]
lea rdx, [0x100001794]
lea rcx, [rsp + 0x40]
mov r9d, edi
mov r8d, edi
call fcn.100019880
lea r9, [rsp + 0x34]
mov r8d, edi
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edx, dword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp rbx, rbp
je 0x10000523e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x34]
mov rdx, rbx
mov rcx, rsi
mov r8d, eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.10001d950
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret

Function at 0x100005268
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rsp + 0x50], 0
mov rbx, rdx
mov rsi, rcx
mov r8, rdx
mov ecx, 0x100000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsi + 0x80], rax
test rax, rax
jne 0x10000532a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1000052c9
lea r8, [rsp + 0x50]
lea edx, [rax - 1]
lea rcx, [0x100001798]
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x1000052e1
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x10001
lea rcx, [rax + 0x60]
call fcn.1000189fc
xor eax, eax
jmp 0x10000532f
xor eax, eax
lea rdi, [rsp + 0x20]
mov r8, rbx
lea edx, [rax + 0x18]
mov rcx, rdx
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x50]
and dword [rsp + 0x30], 0
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 0x80], rax
test rax, rax
je 0x1000052c9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x100012040
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x20], 0
and qword [rax - 0x18], 0
mov rbx, rcx
mov rcx, qword [r9]
mov rsi, r9
mov rdi, rdx
test rcx, rcx
je 0x100012077
call fcn.10001d9c6
and qword [rsi], 0
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x10001216d
mov rbp, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea rdx, [0x100002a60]
mov r9, rbp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x10001216d
cmp dword [rbp], eax
jbe 0x100012168
cmp dword [rbp], 2
jbe 0x1000120f8
cmp dword [rbp], 3
jbe 0x100012168
cmp dword [rbp], 5
jbe 0x1000120f8
cmp dword [rbp], 7
jne 0x100012168
mov edx, dword [rsp + 0x68]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
jne 0x100012114
lea ebx, [rax + 8]
jmp 0x10001216d
xor eax, eax
mov rdi, rbp
lea rdx, [0x100002a60]
lea ecx, [rax + 8]
mov r9, rbp
xor r8d, r8d
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov eax, dword [rsp + 0x68]
dec eax
and qword [rsi + rax*8], 0
test ebx, ebx
je 0x10001216d
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsi], 0
jmp 0x10001216d
mov ebx, 0x70c
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10001217d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100019548
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rax, qword [0x100027110]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x1000033fc]
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov dword [rcx], eax
movzx eax, word [0x100003400]
xor r13d, r13d
mov rbp, rdx
mov rsi, r13
mov word [rcx + 4], ax
cmp rdi, r13
je 0x100019644
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, r13d
je 0x100019644
cmp rbp, r13
je 0x1000195b9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, r13d
jne 0x1000195be
lea rbp, [rsp + 0x20]
mov rbx, rdi
cmp word [rdi], r13w
je 0x1000195e2
movzx edx, word [rbx]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r13
je 0x1000195e2
add rbx, 2
cmp word [rbx], r13w
jne 0x1000195c7
movzx eax, word [rbx]
mov r12, rbx
cmp ax, r13w
je 0x100019622
movzx edx, ax
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r13
je 0x100019609
cmp rsi, r13
jne 0x10001960c
mov rsi, rbx
jmp 0x10001960c
mov rsi, r13
add rbx, 2
mov ax, word [rbx]
cmp ax, r13w
jne 0x1000195ee
cmp rsi, r13
je 0x100019622
mov word [rsi], r13w
cmp r12, rdi
jbe 0x10001963f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, r12
mov rcx, rdi
lea r8d, [rax + 1]
call fcn.100019abc
mov rax, rdi
jmp 0x10001964b
lea rax, [0x100003394]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.10001d950
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10001c004
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rsi, rcx
xor ebx, ebx
xor ecx, ecx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rsi, rbx
je 0x10001c1bd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
je 0x10001c1bd
lea ebp, [rbx + 4]
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x10001c067
xor eax, eax
jmp 0x10001c1c2
mov r8d, dword [rsp + 0x40]
mov edi, 1
xor edx, edx
lea ecx, [rdi + 0xd]
mov r9d, edi
call fcn.1000181f0
mov r12, rax
cmp rax, rbx
jne 0x10001c09b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x10001c060
lea ecx, [rdi + 7]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10001c060
lea r8, [rsp + 0x40]
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
cmp eax, ebx
je 0x10001c060
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, r12
call fcn.100019c80
cmp eax, ebx
jne 0x10001c0cb
mov eax, edi
jmp 0x10001c1c2
mov rcx, rsi
call fcn.10001c2d8
xor edx, edx
mov dword [rsp + 0x40], ebx
lea r8, [rsp + 0x40]
cmp eax, edi
jne 0x10001c161
xor r9d, r9d
mov rcx, rsi
call fcn.10001c3b8
cmp eax, ebx
je 0x10001c060
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov r9d, edi
lea ecx, [rdx + 0xf]
call fcn.1000181f0
mov rbp, rax
cmp rax, rbx
je 0x10001c060
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call fcn.10001c3b8
cmp eax, ebx
je 0x10001c060
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, r12
call fcn.100019c80
cmp eax, ebx
je 0x10001c0c4
lea rdx, [0x1000034c0]
mov r8d, edi
xor r9d, r9d
mov rcx, rbp
call fcn.100019c80
cmp eax, ebx
sete bl
mov eax, ebx
jmp 0x10001c1c2
mov r12d, 7
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x10001c060
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov r9d, edi
lea ecx, [rdx + 0xe]
call fcn.1000181f0
mov rbp, rax
cmp rax, rbx
je 0x10001c060
lea r8, [rsp + 0x40]
mov rdx, rax
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
cmp eax, ebx
je 0x10001c060
mov rdx, rsi
jmp 0x10001c14a
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x10001c3b8
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x100027110]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
and dword [rsp + 0x20], 0
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
je 0x10001c550
test rbx, rbx
je 0x10001c550
cmp dword [r8], 0
je 0x10001c412
cmp dword [r8], 2
jb 0x10001c550
test rdx, rdx
je 0x10001c550
cmp dword [0x10002774c], 0
jne 0x10001c446
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10001c43c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
jmp 0x10001c55d
mov dword [0x10002774c], 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 5
mov ecx, eax
mov dword [rsp + 0x24], eax
call fcn.10001a944
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x10001c480
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10001c563
lea ecx, [rax + 8]
jmp 0x10001c55d
lea r8, [rsp + 0x24]
mov rdx, rax
mov rcx, rsi
call fcn.10001a3e8
test eax, eax
je 0x10001c563
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x10001c4cc
lea rcx, [rsp + 0x28]
call fcn.10001a868
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10001c563
mov ecx, 0x42b
jmp 0x10001c55d
mov edx, 4
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 2]
call qword [sym.imp.WS2_32.dll_gethostbyaddr]
mov qword [0x100027860], rax
test rax, rax
je 0x10001c4b4
lea rcx, [rsp + 0x28]
call fcn.10001a868
xor r9d, r9d
xor r8d, r8d
lea ecx, [r9 + 0x11]
mov rdx, rsi
call fcn.1000181f0
test rax, rax
je 0x10001c46a
mov rax, qword [0x100027860]
test rax, rax
je 0x10001c563
mov rcx, qword [rax]
test rcx, rcx
je 0x10001c549
lea rdx, [0x100003510]
call qword [sym.imp.msvcrt.dll_strtok]
test rax, rax
je 0x10001c549
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call fcn.10001a2cc
test eax, eax
je 0x10001c563
mov eax, 1
jmp 0x10001c565
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10001c563
lea ecx, [rax + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.10001d950
mov rbx, qword [rsp + 0x218]
add rsp, 0x1e0
pop rdi
pop rsi
pop rbp
ret

Function at 0x10001db58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10001dba5
cmp rcx, 0xffffffffffffffff
je 0x10001dba5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10001db9d
cmp dword [rcx + 0x3c], edx
jl 0x10001db9d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10001db9d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10001dba5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140e9e368
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e9e372
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e9e39b
pop rbp
sub rbp, 0x33
sub rbp, 0xe9e368
sub rsp, 0x20
jmp 0x140e9e3ba
mov rax, 0xe9e368
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffd58178f0
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e9e3d9
jmp 0x140e9e3f0
mov eax, 0x797b1979
int3
Function at 0x140001500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r11
push rdi
push r13
mov r11d, 0x60
mov rdi, qword gs:[r11]
push rdx
mov r11, rdi
add r11, 0x10
mov rdx, qword [r11]
add rdi, 0x18
mov r13, qword [rdi]
add r13, 0x10
mov rdi, qword [r13]
push r10
mov r13, rdi
add r13, 0x30
mov r11, qword [r13]
cmp r11, 0
je 0x14000156b
mov r13, qword [rdi + 0x60]
mov r10, qword [r13]
and r10d, 0xdf00df
mov r13, qword [r13 + 0xc]
shl r13d, 8
add r13d, r10d
shl r13d, 2
sub r13d, 0xc914cd2c
cmp r13, 0
je 0x140001573
mov rdi, qword [rdi]
jmp 0x14000152b
mov edi, dword [r11 + 0x3c]
add rdi, r11
add rdi, 0x10
mov r13d, dword [rdi + 0x78]
add r13, r11
push rcx
mov r10d, dword [r13 + 0x20]
add r10, r11
mov ecx, dword [r10]
add rcx, r11
mov edi, dword [rcx + 0xb]
add edi, 0xff8b9c9b
test edi, edi
jne 0x1400015a2
jmp 0x1400015b0
inc r10
inc r10
inc r10
inc r10
jmp 0x14000158d
mov edi, dword [r13 + 0x20]
sub r10, r11
sub r10, rdi
shr r10d, 1
mov edi, dword [r13 + 0x24]
add rdi, r10
add rdi, r11
mov r10d, dword [rdi]
shl r10d, 0x10
shr r10d, 0xe
shr edx, 0xe
mov edi, dword [r13 + 0x1c]
add rdi, r10
add rdi, r11
mov r10d, dword [rdi]
add r10, r11
movabs rdi, 0x85000
add rdi, rdx
push r11
push rdx
push rdi
push rcx
push rcx
push rdi
mov rcx, rdi
mov edx, 0xb9000
mov r9, rsp
sub r8, r8
add r8, 0x40
call r10
pop r13
pop rcx
pop rcx
pop rdi
pop rdx
movabs r11, 0x6c31
mov r13d, 0x3b2c0
push r10
mov r10d, 4
imul r11d, r10d
movabs r10, 0x615d
add r10, rdx
add r11, r10
call fcn.140001663
mov edi, 0xc6000
mov r11d, 0x5d621
add r11, rdx
add rdi, rdx
mov r13d, 0x3ad0
call fcn.140001663
pop r10
jmp 0x140001690
nop
ret
mov r11d, 0x8000000
mov r13d, 0xdc
mov edi, 0x85000
mov r10d, 0x12
imul r13d, r10d
add r13d, 0x88
add rdi, rdx
sub rdi, r13
mov r13, rdi
sub r13, r11
movabs r11, 0x62221
add r11, rdx
mov r10d, dword [r11]
xor r10d, 0xd6656056
dec r10
test r10d, r10d
je 0x1400016ef
add r10, rdi
mov rcx, qword [r10]
add rcx, r13
mov qword [r10], rcx
add r11, 4
jmp 0x1400016cb
push rdi
movabs rdi, 0x1ce3
sub rsp, 0x18
mov r11d, 0x5589
push r13
add r11, rdx
add r11, rdi
add r11, 0x95ec0
push r11
inc r10
lea r13d, [r10d]
jmp 0x14000168e
Function at 0x140001540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r11
push rdi
push r13
mov r11d, 0x60
mov rdi, qword gs:[r11]
push rdx
mov r11, rdi
add r11, 0x10
mov rdx, qword [r11]
add rdi, 0x18
mov r13, qword [rdi]
add r13, 0x10
mov rdi, qword [r13]
push r10
mov r13, rdi
add r13, 0x30
mov r11, qword [r13]
cmp r11, 0
je 0x14000156b
mov r13, qword [rdi + 0x60]
mov r10, qword [r13]
and r10d, 0xdf00df
mov r13, qword [r13 + 0xc]
shl r13d, 8
add r13d, r10d
shl r13d, 2
sub r13d, 0xc914cd2c
cmp r13, 0
je 0x140001573
mov rdi, qword [rdi]
jmp 0x14000152b
mov edi, dword [r11 + 0x3c]
add rdi, r11
add rdi, 0x10
mov r13d, dword [rdi + 0x78]
add r13, r11
push rcx
mov r10d, dword [r13 + 0x20]
add r10, r11
mov ecx, dword [r10]
add rcx, r11
mov edi, dword [rcx + 0xb]
add edi, 0xff8b9c9b
test edi, edi
jne 0x1400015a2
jmp 0x1400015b0
inc r10
inc r10
inc r10
inc r10
jmp 0x14000158d
mov edi, dword [r13 + 0x20]
sub r10, r11
sub r10, rdi
shr r10d, 1
mov edi, dword [r13 + 0x24]
add rdi, r10
add rdi, r11
mov r10d, dword [rdi]
shl r10d, 0x10
shr r10d, 0xe
shr edx, 0xe
mov edi, dword [r13 + 0x1c]
add rdi, r10
add rdi, r11
mov r10d, dword [rdi]
add r10, r11
movabs rdi, 0x85000
add rdi, rdx
push r11
push rdx
push rdi
push rcx
push rcx
push rdi
mov rcx, rdi
mov edx, 0xb9000
mov r9, rsp
sub r8, r8
add r8, 0x40
call r10
pop r13
pop rcx
pop rcx
pop rdi
pop rdx
movabs r11, 0x6c31
mov r13d, 0x3b2c0
push r10
mov r10d, 4
imul r11d, r10d
movabs r10, 0x615d
add r10, rdx
add r11, r10
call fcn.140001663
mov edi, 0xc6000
mov r11d, 0x5d621
add r11, rdx
add rdi, rdx
mov r13d, 0x3ad0
call fcn.140001663
pop r10
jmp 0x140001690
nop
ret
mov r11d, 0x8000000
mov r13d, 0xdc
mov edi, 0x85000
mov r10d, 0x12
imul r13d, r10d
add r13d, 0x88
add rdi, rdx
sub rdi, r13
mov r13, rdi
sub r13, r11
movabs r11, 0x62221
add r11, rdx
mov r10d, dword [r11]
xor r10d, 0xd6656056
dec r10
test r10d, r10d
je 0x1400016ef
add r10, rdi
mov rcx, qword [r10]
add rcx, r13
mov qword [r10], rcx
add r11, 4
jmp 0x1400016cb
push rdi
movabs rdi, 0x1ce3
sub rsp, 0x18
mov r11d, 0x5589
push r13
add r11, rdx
add r11, rdi
add r11, 0x95ec0
push r11
inc r10
lea r13d, [r10d]
jmp 0x14000168e