joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180051410
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rax - 0x28], xmm6
xor r14d, r14d
cmp byte [0x1800d05d9], r14b
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
je 0x180051636
mov rax, qword [0x1800d0678]
test rax, rax
jne 0x1800514f1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800514d6
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x1800514d6
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [rsi + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x1800514d2
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x1800514af
cmp r11d, 0x95466b05
je 0x18005156b
test edx, edx
jne 0x180051493
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x1800514e7
cmp qword [rax + 0x30], r14
jne 0x18005146f
mov rax, r14
mov qword [0x1800d0678], rax
mov ecx, dword [0x1800cf428]
call rax
test ax, ax
jns 0x180051636
call fcn.18004c9bc
mov rbx, rax
test rax, rax
je 0x180051636
cmp dword [0x1800cf458], 1
jne 0x180051636
movss xmm9, dword [0x1800d01a8]
lea rcx, [rbp - 0x50]
movss xmm6, dword [0x1800d01ac]
xor r8d, r8d
mulss xmm9, dword [0x180058b0c]
mov rdx, rax
mulss xmm6, dword [0x180058b0c]
call fcn.18004c67c
mov ecx, dword [0x1800d05e8]
sub ecx, 1
je 0x180051590
sub ecx, 1
je 0x180051588
cmp ecx, 1
jne 0x1800515a2
mov r8d, ecx
jmp 0x180051596
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x1800514ea
mov r8d, 8
jmp 0x180051596
mov r8d, 0x14
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.18004c67c
movsd xmm8, qword [rbp - 0x50]
lea rdx, [rbp - 0x50]
mov ebx, dword [rbp - 0x48]
lea rcx, [rbp + 0x20]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.1800509e4
movss xmm0, dword [rbp + 0x24]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x180060878]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x180060878]
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0x20]
cvtps2pd xmm0, xmm0
cvtps2pd xmm2, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
mov eax, dword [0x1800cf42c]
lea ecx, [rax + rax*4]
add ecx, ecx
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x180051636
lea rcx, [rbp - 0x50]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.18004c2a0
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800554c8
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1800cf540]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x180055430]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x18005553f
mov qword [rsp + 0x20], 0xc8
lea rdx, [rsp + 0x30]
lea rcx, [0x180055430]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.180047df4
mov rcx, rax
call fcn.180048060
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18005550c
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180055b00
add rsp, 0xd8
ret
Function at 0x140001480
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, [0x140003438]
lea rcx, [0x140003440]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edx, 1
mov dword [rsp + 0x20], 0x3020100
mov r9, rax
mov dword [rsp + 0x24], 0x7060504
lea rcx, [rsp + 0x20]
mov word [rsp + 0x28], 0x908
lea r8d, [rdx + 9]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ebx, 0x64
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003450]
call fcn.140001620
mov rcx, rax
lea rdx, [0x1400017f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
sub rbx, 1
jne 0x1400014e2
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140001840
add rsp, 0xa0
pop rbx
ret

Function at 0x1400021c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000220a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000220a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000220a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000220a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000220a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000220c
xor al, al
add rsp, 0x28
ret
Function at 0x180004bd0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x1801f9008]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.1800b62e0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1801f9008]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x180004d60
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x180004d7c
cmp rcx, r8
jl 0x180004d6f
mov qword [rdx + 0x80], rcx
test dword [0x1801f2938], 1
je 0x180004dab
cmp byte [rsp + 0xd0], 0
je 0x180004dab
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1800048d0
mov rsp, r8
jmp rax
Function at 0x18006f820
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18006f848
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18006f848
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1800724d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1800bb6a0
nop
test rbx, rbx
jne 0x180072521
xor edx, edx
jmp 0x180072525
lea rdx, [rbx + 0xc]
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x88], rdx
mov r8, rsi
mov qword [rbp - 0x90], r8
mov r9, rdi
mov qword [rbp - 0x98], r9
lea rcx, [rbp - 0x78]
call fcn.1800060d0
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x88]
mov r8, qword [rbp - 0x90]
mov r9, qword [rbp - 0x98]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.180006120
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1800725ae
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1800bb6e0
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180078940
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x48]
test rcx, rcx
je 0x18007897f
add rcx, 0xc
mov qword [rbp - 0x40], rcx
mov rcx, qword [rbp - 0x40]
jmp 0x180078981
xor ecx, ecx
test rdx, rdx
je 0x180078994
add rdx, 0xc
mov qword [rbp - 0x48], rdx
mov rdx, qword [rbp - 0x48]
jmp 0x180078996
xor edx, edx
cmp byte [rbp + 0x30], 0
setne r10b
movzx r10d, r10b
test rax, rax
je 0x1800789b5
add rax, 0xc
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
jmp 0x1800789b7
xor eax, eax
mov dword [rsp + 0x20], r10d
mov r10d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r10d
mov r10, qword [rbp + 0x40]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x88], rdx
mov qword [rbp - 0x90], r8
mov qword [rbp - 0x98], r9
lea rcx, [rbp - 0x78]
call fcn.1800060d0
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x88]
mov r8, qword [rbp - 0x90]
mov r9, qword [rbp - 0x98]
call sub.KERNEL32.dll_CreateProcessW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.180006120
test ebx, ebx
setne al
movzx eax, al
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180079130
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov rsi, rdx
mov edi, r8d
mov rbx, r9
xor edx, edx
mov dword [rbx], edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1800bb6a0
nop
mov qword [rbp - 0x50], rbx
lea r14, [rsi + 0x10]
xor ecx, ecx
test rsi, rsi
cmove r14, rcx
mov qword [rbp - 0x58], r14
mov rcx, qword [rbp - 0x48]
mov rsi, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15d, dword [rbp + 0x30]
mov dword [rsp + 0x20], r15d
mov rcx, rsi
mov qword [rbp - 0x8c], rcx
mov rdx, r14
mov qword [rbp - 0x94], rdx
mov r8d, edi
mov dword [rbp - 0x84], r8d
mov r9, rbx
mov qword [rbp - 0x9c], r9
lea rcx, [rbp - 0x80]
call fcn.1800060d0
mov rcx, qword [rbp - 0x8c]
mov rdx, qword [rbp - 0x94]
mov r8d, dword [rbp - 0x84]
mov r9, qword [rbp - 0x9c]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
mov ebx, eax
lea rcx, [rbp - 0x80]
call fcn.180006120
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
test ebx, ebx
setne bl
movzx ebx, bl
cmp byte [rbp - 0x40], 0
je 0x180079238
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1800bb6e0
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801f9008]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x180079272
mov dword [rdi + 0x78], esi
movzx eax, bl
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x1800c1fd0]
call rax
mov rdi, rax
jmp 0x180079258

Function at 0x180079650
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov ebx, edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1800bb6a0
mov rcx, qword [rbp - 0x48]
mov rsi, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rsi
mov qword [rbp - 0x7c], rcx
mov edx, ebx
mov dword [rbp - 0x74], edx
lea rcx, [rbp - 0x70]
call fcn.1800060d0
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
call sub.KERNEL32.dll_TerminateProcess
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.180006120
call sub.KERNEL32.dll_GetLastError
mov esi, eax
test ebx, ebx
setne bl
movzx ebx, bl
cmp byte [rbp - 0x40], 0
je 0x1800796e3
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1800bb6e0
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801f9008]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x18007971a
mov dword [rdi + 0x78], esi
movzx eax, bl
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x1800c1fd0]
call rax
mov rdi, rax
jmp 0x180079703
Function at 0x18007b570
Capabilities:
Enumerate process modules

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x18013cc58]
cmp qword [rcx - 8], 0
jne 0x18007b5ae
mov rcx, rbx
call fcn.18007b330
test eax, eax
je 0x18007b5a4
mov rcx, rbx
mov edx, 1
add rsp, 0x20
pop rbx
jmp fcn.18007c560
add rsp, 0x20
pop rbx
jmp fcn.18007c5e0
call fcn.180001057
jmp 0x18007b586
Function at 0x18007e7d0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x64], r8d
mov rdx, rcx
mov qword [rbp - 0x70], rdx
xor ecx, ecx
mov qword [rbp - 0x78], rcx
mov r9d, 2
mov dword [rbp - 0x68], r9d
lea rcx, [rbp - 0x60]
call fcn.1800060d0
mov r8d, dword [rbp - 0x64]
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov r9d, dword [rbp - 0x68]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x60]
call fcn.180006120
test ebx, ebx
jne 0x18007e844
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
je 0x18007e86c
lea rcx, [0x180140960]
call fcn.180004450
mov rbx, rax
mov rcx, rbx
call fcn.18008bf60
mov rcx, rbx
call fcn.1800049c0
int3
lea rcx, [0x180141058]
call fcn.180004450
mov rbx, rax
mov rcx, rbx
call fcn.180090250
mov rcx, rbx
call fcn.1800049c0
int3

Function at 0x18007ed40
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x50]
mov rbx, rcx
mov eax, dword [rbx + 0x38]
cmp eax, 0xffffffff
jne 0x18007ede7
mov dword [rsp + 0x20], 0x10
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov r9d, 4
call fcn.1800c8890
mov ecx, eax
test ecx, ecx
jne 0x18007edee
xor eax, eax
mov ecx, 0x40000000
test byte [rbp - 0x10], 0x30
cmove eax, ecx
mov ecx, eax
or ecx, 0x80000000
test byte [rbp - 0x10], 2
cmovne eax, ecx
mov ecx, eax
or ecx, 0x10000000
test dword [rbp - 0x10], 0x800
cmovne eax, ecx
mov ecx, eax
or ecx, 0x8000000
test byte [rbp - 0x10], 4
cmovne eax, ecx
mov ecx, eax
or ecx, 0x4000000
test dword [rbp - 0x10], 0x1000
cmovne eax, ecx
mov ecx, eax
or ecx, 0x20000000
test byte [rbp - 0x10], 8
cmovne eax, ecx
mov dword [rbx + 0x38], eax
add rsp, 0x48
pop rbx
pop rbp
ret
add rsp, 0x48
pop rbx
pop rbp
ret
call fcn.1800c8760
mov ecx, eax
lea rdx, [0x180123a28]
xor r8d, r8d
call fcn.1800b3400
mov rcx, rax
call fcn.1800049c0
int3

Function at 0x180081b90
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x180081ba2
add rsp, 0x28
jmp fcn.180082260
lea rcx, [0x18013a300]
call fcn.18008a2e0
int3
Function at 0x180081da0
Capabilities:
Get session user name

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
mov rbx, rcx
xor ecx, ecx
mov dword [rbp - 0x3c], ecx
mov rcx, qword gs:[0x58]
mov eax, dword [0x1801f9008]
mov edx, 0x10
add rdx, qword [rcx + rax*8]
mov rsi, qword [rdx]
test rsi, rsi
je 0x180081eb3
mov qword [rbp - 0x78], rsi
jmp 0x180081df5
sub edx, dword [rbx + 8]
mov rcx, rbx
call fcn.1800adaf0
mov qword [rbp + 0x10], rbx
mov rdi, qword [rbx + 0x10]
lea r14, [rbp - 0x3c]
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r8, r14
mov qword [rbp - 0x84], r8
mov rdx, rdi
mov qword [rbp - 0x8c], rdx
mov ecx, 2
mov dword [rbp - 0x7c], ecx
lea rcx, [rbp - 0x70]
call fcn.1800060d0
mov r8, qword [rbp - 0x84]
mov rdx, qword [rbp - 0x8c]
mov ecx, dword [rbp - 0x7c]
call sub.Secur32.dll_GetUserNameExW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.180006120
movzx ebx, bl
call sub.KERNEL32.dll_GetLastError
xor edx, edx
mov qword [rbp - 0x48], rdx
mov rsi, qword [rbp - 0x78]
mov dword [rsi + 0x78], eax
test ebx, ebx
jne 0x180081e98
cmp dword [rsi + 0x78], 0xea
je 0x180081e7f
xor edx, edx
mov rbx, qword [rbp + 0x10]
mov dword [rbx + 8], edx
jmp 0x180081ea2
mov edx, dword [rbp - 0x3c]
test edx, edx
jl 0x180081ec7
mov rbx, qword [rbp + 0x10]
cmp edx, dword [rbx + 0x18]
jbe 0x180081df5
jmp 0x180081dea
mov ecx, dword [rbp - 0x3c]
mov rbx, qword [rbp + 0x10]
mov dword [rbx + 8], ecx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x1800c1fd0]
call rax
mov rsi, rax
jmp 0x180081de4
call fcn.1800c4b30
int3
Function at 0x1800912a0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
mov rsi, rcx
mov rdi, r8
mov r8d, edx
mov ebx, r9d
test ebx, ebx
je 0x1800914bf
lea ebp, [rbx - 1]
test ebp, ebp
je 0x180091466
xor r14d, r14d
movzx r15d, word [rdi]
sub r8d, ebp
mov r13d, r8d
cmp r13d, 8
jl 0x1800913db
movsxd rcx, ebp
movzx ecx, word [rdi + rcx*2]
movsxd rbp, ebp
jmp 0x180091303
dec rbp
movzx ecx, word [rdi + rbp*2]
cmp ecx, r15d
jne 0x18009130e
cmp rbp, 1
jg 0x1800912fc
movd xmm0, r15d
movaps xmm6, xmm0
punpcklwd xmm6, xmm0
pshufd xmm6, xmm6, 0
movd xmm0, ecx
movaps xmm7, xmm0
punpcklwd xmm7, xmm0
pshufd xmm7, xmm7, 0
movsxd r13, r13d
lea r15, [r13 - 8]
jmp 0x18009133b
mov r14, r15
movups xmm0, xmmword [rsi + r14*2]
pcmpeqw xmm0, xmm6
lea rcx, [r14 + rbp]
movups xmm1, xmmword [rsi + rcx*2]
pcmpeqw xmm1, xmm7
pand xmm0, xmm1
xorps xmm1, xmm1
pcmpeqb xmm1, xmm0
pmovmskb ecx, xmm1
cmp ecx, 0xffff
je 0x1800913c4
pmovmskb r12d, xmm0
test r12d, r12d
je 0x180091377
bsf ecx, r12d
jmp 0x18009137c
mov ecx, 0x20
shr ecx, 1
mov eax, ecx
mov qword [rsp + 0x28], rax
cmp ebx, 2
je 0x1800913bc
lea rcx, [r14 + rax]
lea rcx, [rsi + rcx*2]
mov r8d, ebx
add r8, r8
mov rdx, rdi
call fcn.180090da0
test eax, eax
mov rax, qword [rsp + 0x28]
jne 0x1800913bc
lea ecx, [r12 - 1]
and ecx, r12d
lea r12d, [rcx - 1]
and r12d, ecx
jne 0x18009136c
jmp 0x1800913c4
add eax, r14d
jmp 0x18009144b
add r14, 8
cmp r14, r13
je 0x180091428
cmp r14, r15
jle 0x18009133b
jmp 0x180091338
add rdi, 2
test r13d, r13d
jle 0x180091428
lea rcx, [rsi + r14*2]
movsx rdx, r15w
mov r8d, r13d
call fcn.180115ae0
test eax, eax
jl 0x180091428
sub r13d, eax
movsxd rcx, eax
add r14, rcx
test r13d, r13d
jle 0x180091428
lea rcx, [rsi + r14*2 + 2]
mov r8d, ebp
add r8, r8
mov rdx, rdi
call fcn.180090da0
test eax, eax
jne 0x180091448
dec r13d
inc r14
test r13d, r13d
jg 0x1800913e4
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movsx rdx, word [rdi]
movzx ecx, dx
dec ecx
cmp ecx, 0xfe
jb 0x180091499
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.180115ae0
movsx rdx, dx
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.18011ed60
xor eax, eax
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret