joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eaca0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4ead75
movdqa xmm0, xmmword [0x005d9ae0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4eace1
movdqa xmm0, xmmword [0x005d9af0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4eadf7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4eadcb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005d98a0]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x005d9b00]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x526100
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x526117
inc rax
cmp rax, 4
jge 0x52612f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x526114
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x526140
inc rax
cmp rax, 4
jge 0x52614e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x526177
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x52615b
jmp 0x52613d

Function at 0x5349c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x534b0e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x006ca170]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726ac8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x534ad2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x534b08
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x534afd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x54d600
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x54d849
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x54d834
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x54d642
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x54d65c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call sym.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x54d771
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005d8840]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call sym.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726ac8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x54d73b
xor eax, eax
lea rbx, [0x005d87b8]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005a0a7e]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call sym.runtime.concatstring4
jmp 0x54d768
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005d8888]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726ac8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x54d7fe
xor eax, eax
lea rbx, [0x005d87b8]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005a0a7e]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call sym.runtime.concatstring4
jmp 0x54d82b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005d8888]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
lea rax, [0x005a0ddb]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net._TCPAddr_.String
Function at 0x54e7c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x54ea09
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x54e9f4
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x54e802
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x54e81c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call sym.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x54e931
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005d8840]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call sym.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726ac8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x54e8fb
xor eax, eax
lea rbx, [0x005d87b8]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005a0a7e]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call sym.runtime.concatstring4
jmp 0x54e928
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005d8888]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00726ac8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x54e9be
xor eax, eax
lea rbx, [0x005d87b8]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005a0a7e]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call sym.runtime.concatstring4
jmp 0x54e9eb
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005d8888]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
lea rax, [0x005a0ddb]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net._UDPAddr_.String
Function at 0x180008f30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.18010e6d0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180008fae
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x180008f8e
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call fcn.180111250
mov rcx, rdi
test eax, eax
je 0x180008fda
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180008f81
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800ef540
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x180008fb9
Function at 0x180011f70
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x850
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x180011fc1
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rsi, rax
mov rbp, qword [rdi + 0x18]
test rax, rax
jne 0x180011fdf
mov rsi, rdi
cmp rbp, 8
jb 0x180011fdf
mov rsi, qword [rdi]
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x40]
call fcn.18010e6d0
mov r9, qword [rdi + 0x10]
cmp rbp, 8
jb 0x180011ffe
mov rdi, qword [rdi]
mov r8, rdi
mov edx, 0x3ff
lea rcx, [rsp + 0x40]
call fcn.1801110dc
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.MxStart.exe
mov rcx, rsi
call fcn.180111250
test eax, eax
jne 0x18001208c
lea rdx, str.Maxthon.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180012155
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x180012070
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180004a10
jmp 0x180012178
lea rdx, str.TSBrowserLauncher.exe
mov rcx, rsi
call fcn.180111250
test eax, eax
jne 0x1800120f4
lea rdx, str.TSBrowser.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180012155
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x1800120e0
lea rdx, [rsp + 0x40]
jmp 0x18001216f
lea rdx, str.DCBrowserLauncher.exe
mov rcx, rsi
call fcn.180111250
test eax, eax
jne 0x180012155
lea rdx, str.DCBrowser.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180012155
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x180012144
lea rdx, [rsp + 0x40]
jmp 0x18001216f
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
xor r8d, r8d
lea rdx, [0x180163940]
mov rcx, rbx
call fcn.180004a10
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1800ef540
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180015a10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
test rcx, rcx
je 0x180015bc0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov ecx, dword [rax + 0x90]
test ecx, ecx
je 0x180015bc0
lea r14, [rsi + rcx]
cmp dword [r14], 0
je 0x180015bc0
lea r12, [0x180166068]
movabs r13, 0x8000000000000000
xor r15d, r15d
nop dword [rax + rax]
mov ebx, dword [r14 + 0xc]
add rbx, rsi
lea rcx, [0x180166020]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
lea rdx, [0x180166020]
mov rcx, rbx
call fcn.180124000
test eax, eax
jne 0x180015bb2
mov edi, dword [r14]
add rdi, rsi
mov rax, qword [rdi]
test rax, rax
je 0x180015bb2
js 0x180015ba2
cmp r12, r13
jae 0x180015ba2
lea rbx, [rsi + 2]
add rbx, rax
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x180015b05
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.180012f50
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
mov rdx, r12
call fcn.18011b6b0
test eax, eax
jne 0x180015b57
mov dword [rbp - 0x40], r15d
lea r9, [rbp - 0x40]
lea r8d, [rax + 0x40]
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180015bec
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180015b92
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015b8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015c54
call fcn.1800ef5a0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
add rdi, 8
mov rax, qword [rdi]
test rax, rax
jne 0x180015ad0
add r14, 0x14
cmp dword [r14], 0
jne 0x180015a90
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800ef540
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, str.kernel23
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.180114338
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180015c37
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015c32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015c4e
call fcn.1800ef5a0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov al, 1
jmp 0x180015bc2
call fcn.180111064
int3
call fcn.180111064
int3
Function at 0x180017300
Capabilities:
Create shortcut via ishelllink

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x4f0], rbx
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rdi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.18009eb00
nop
xor esi, esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x18014c9a0]
xor edx, edx
lea r8d, [rsi + 1]
lea rcx, [0x18014c9d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800174b0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800174b0
mov qword [rsp + 0x40], rsi
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x18014c9c0]
call qword [rax]
mov rcx, qword [rsp + 0x40]
test eax, eax
js 0x180017472
test rcx, rcx
je 0x180017472
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x28]
mov ebx, eax
test eax, eax
js 0x18001746b
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
xor edx, edx
mov r8d, 0x3e80001
call qword [rax + 0x98]
mov ebx, eax
test eax, eax
js 0x18001746b
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x50]
call fcn.18010e6d0
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x1a0]
call fcn.18010e6d0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x50]
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
js 0x18001746b
mov word [rbp + 0x3a8], si
lea rcx, [rbp + 0x1a0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], si
jne 0x180017450
mov r8, rax
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
call fcn.180004a10
mov rcx, qword [rsp + 0x40]
jmp 0x180017479
mov rbx, 0xffffffffffffffff
test rcx, rcx
je 0x180017489
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18001749e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x30]
call fcn.18009ec20
test ebx, ebx
js 0x1800174ba
xor eax, eax
jmp 0x1800174bf
lea rcx, [rsp + 0x30]
call fcn.18009ec20
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1800ef540
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001ae70
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x470
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, rdx
mov qword [rsp + 0x40], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], 7
mov word [rdx], bx
mov dword [rsp + 0x20], 1
lea rax, str._programfiles_x86__Internet_Exploreriexplore.exe
mov qword [rsp + 0x28], rax
lea rax, str._programfiles_Internet_Exploreriexplore.exe
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x28]
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x50]
call fcn.18010e6d0
mov r8d, 0x208
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18001af23
inc ebx
add rdi, 8
cmp ebx, 2
jb 0x18001aee0
jmp 0x18001af48
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18001af30
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.180004a10
mov rax, rsi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800ef540
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001cc20
Capabilities:
Create shortcut via ishelllink

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x5d0]
sub rsp, 0x6d0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x700], rbx
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov rsi, r9
mov r14, r8
mov rbx, rdx
lea rcx, [rsp + 0x30]
call fcn.18009eb00
nop
xor r15d, r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x18014c9a0]
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [0x18014c9d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18001ce48
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18001ce48
mov qword [rsp + 0x40], r15
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x18014c9c0]
call qword [rax]
mov edi, eax
test eax, eax
js 0x18001ce0c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18001ce21
cmp qword [rbx + 0x18], 8
jb 0x18001cce7
mov rbx, qword [rbx]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x28]
mov edi, eax
test eax, eax
js 0x18001ce0c
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
xor edx, edx
mov r8d, 0x3e80001
call qword [rax + 0x98]
mov edi, eax
test eax, eax
js 0x18001ce0c
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x50]
call fcn.18010e6d0
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x1a0]
call fcn.18010e6d0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x50]
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
call qword [rax + 0x18]
mov edi, eax
test eax, eax
js 0x18001ce0c
mov word [rbp + 0x3a8], r15w
lea rax, [rbp + 0x1a0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x18001cd90
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call fcn.180004a10
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x3b0]
call fcn.18010e6d0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov r8d, 0x104
lea rdx, [rbp + 0x3b0]
call qword [rax + 0x50]
mov edi, eax
test eax, eax
js 0x18001ce0c
mov word [rbp + 0x5b8], r15w
lea rax, [rbp + 0x3b0]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x18001cdf0
mov r8, rbx
lea rdx, [rbp + 0x3b0]
mov rcx, rsi
call fcn.180004a10
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18001ce21
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x40], r15
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18001ce36
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x30]
call fcn.18009ec20
test edi, edi
js 0x18001ce52
xor eax, eax
jmp 0x18001ce57
lea rcx, [rsp + 0x30]
call fcn.18009ec20
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.1800ef540
mov rbx, qword [rsp + 0x700]
add rsp, 0x6d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret