joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
xor edx, edx
xor ecx, ecx
call sub.jli.dll_JLI_InitArgProcessing
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001072
lea rcx, str.Windows_original_main_args:_n
call fcn.140001148
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001072
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call fcn.140001148
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x140001047
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010be
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010ab
mov rcx, qword [0x140003010]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010d5
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010e4
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
xor r8d, r8d
mov byte [rsp + 0x58], 1
mov rdx, rbx
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x140002294]
mov qword [rsp + 0x38], rax
lea rax, [0x140002298]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400111d1
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011d08
mov r10, rcx
mov eax, dword [0x14001e198]
syscall
ret

Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140013140
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014490
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400144b0
xor al, al
jmp 0x140014531
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400144c3
xor al, al
jmp 0x140014531
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400144ed
xor al, al
jmp 0x140014531
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014501
xor al, al
jmp 0x140014531
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014513
xor al, al
jmp 0x140014531
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001452f
xor al, al
jmp 0x140014531
mov al, 1
add rsp, 0x38
ret
Function at 0x140011393
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011d14
mov r10, rcx
mov eax, dword [0x14001e174]
syscall
ret

Function at 0x1400113b1
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011cf0
mov r10, rcx
mov eax, dword [0x14001e710]
syscall
ret

Function at 0x1400113b6
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011cfc
mov r10, rcx
mov eax, dword [0x14001e19c]
syscall
ret
Function at 0x1400c13f4
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400c147f
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400c147f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c147f
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400c147b
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400c1475
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x1400c1475
test rdx, rdx
je 0x1400c147b
cmp dword [rdx + 0x24], 0
jge 0x1400c1471
xor al, al
jmp 0x1400c1485
mov al, 1
jmp 0x1400c1485
add rdx, 0x28
jmp 0x1400c1447
xor al, al
jmp 0x1400c1485
xor al, al
jmp 0x1400c1485
add rsp, 0x18
ret
Function at 0x180003020
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rax, qword [0x1800f10e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov qword [rsp + 0x58], rcx
mov rdx, rcx
lea rcx, [0x1800f9080]
call fcn.180003240
lea rcx, [0x1800f90a8]
cmp qword [0x1800f90c0], 0x10
cmovae rcx, qword [0x1800f90a8]
lea rdx, [0x1800f90c8]
cmp qword [0x1800f90e0], 0x10
cmovae rdx, qword [0x1800f90c8]
lea r8, [0x1800f90e8]
cmp qword [0x1800f9100], 0x10
cmovae r8, qword [0x1800f90e8]
lea rax, [0x1800f9108]
cmp qword [0x1800f9120], 0x10
cmovae rax, qword [0x1800f9108]
mov qword [rsp + 0x20], rax
call fcn.18000c7b0
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
xor edi, edi
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x30], dil
lea r8d, [rdi + 0xa]
lea rdx, str.first_load
lea rcx, [rsp + 0x30]
call fcn.1800051c0
nop
lea rcx, [rsp + 0x30]
call fcn.180002cf0
nop
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x180003151
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x18000314c
test cl, 0x1f
je 0x18000311f
call fcn.180072ffc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000312e
call fcn.180072ffc
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000313d
call fcn.180072ffc
int3
cmp rcx, 0x27
jbe 0x180003149
call fcn.180072ffc
int3
mov rcx, rax
call fcn.18006baac
call fcn.180003370
cmp qword [0x1800f7dd0], 0
jne 0x180003165
call fcn.180004730
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x30], 0
mov r8d, 0xa
lea rdx, str.loop_begin
lea rcx, [rsp + 0x30]
call fcn.1800051c0
nop
lea rcx, [rsp + 0x30]
call fcn.180002cf0
nop
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x1800031f3
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x1800031ee
test cl, 0x1f
je 0x1800031c1
call fcn.180072ffc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800031d0
call fcn.180072ffc
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800031df
call fcn.180072ffc
int3
cmp rcx, 0x27
jbe 0x1800031eb
call fcn.180072ffc
int3
mov rcx, rax
call fcn.18006baac
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x180004ff0]
xor edx, edx
xor ecx, ecx
call fcn.180073874
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, rbx
call fcn.180002ee0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18006c2f0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x18000d0f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1c0], rbx
mov rax, qword [0x1800f10e0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov esi, r8d
mov rdi, rdx
mov edx, r8d
lea rcx, [rsp + 0x50]
call fcn.18000d040
nop
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x20], bl
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.180007c70
mov r15, qword [rsp + 0x30]
lea r14, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae r14, qword [rsp + 0x20]
lea rax, [rsp + 0x70]
mov r8d, 0x100
nop dword [rax + rax]
mov byte [rax], bl
inc bx
lea rax, [rax + 1]
cmp bx, r8w
jl 0x18000d190
mov word [rbp + 0x70], 0
xor r11b, r11b
xor r10b, r10b
lea r9, [rsp + 0x70]
movzx edx, byte [r9]
movzx eax, r11b
movzx ecx, byte [rax + r14]
add cl, dl
add r10b, cl
movzx eax, r10b
lea rcx, [rsp + 0x70]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r9], al
mov byte [rcx], dl
movzx eax, r11b
inc eax
cdq
idiv r15d
mov r11d, edx
inc r9
sub r8, 1
jne 0x18000d1b0
movzx r9d, byte [rbp + 0x70]
movzx r10d, byte [rbp + 0x71]
test esi, esi
je 0x18000d242
mov r11, rsi
nop dword [rax]
inc r9b
movzx eax, r9b
lea rdx, [rsp + 0x70]
add rdx, rax
movzx r8d, byte [rdx]
add r10b, r8b
movzx eax, r10b
lea rcx, [rsp + 0x70]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rdx], al
mov byte [rcx], r8b
add r8b, byte [rdx]
movzx eax, r8b
movzx ecx, byte [rsp + rax + 0x70]
xor byte [rdi], cl
lea rdi, [rdi + 1]
sub r11, 1
jne 0x18000d200
lea rcx, [rsp + 0x20]
call fcn.1800052f0
nop
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x18000d2a5
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x18000d2a0
test cl, 0x1f
je 0x18000d273
call fcn.180072ffc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000d282
call fcn.180072ffc
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000d291
call fcn.180072ffc
int3
cmp rcx, 0x27
jbe 0x18000d29d
call fcn.180072ffc
int3
mov rcx, rax
call fcn.18006baac
mov al, 1
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.18006c2f0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180013930
Capabilities:
Encode data using base64

Disassembly:
push rdi
push r14
push r15
mov edi, edx
lea r10d, [rdx*8]
mov r11, rcx
mov eax, 0x2aaaaaab
imul r10d
lea ecx, [rdi*8]
mov r14, r9
mov eax, edx
mov r15, r8
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
je 0x180013975
cmp ecx, 4
jne 0x180013978
add edx, 2
jmp 0x180013978
add edx, 3
inc edx
cmp dword [r9], edx
jge 0x18001398d
mov dword [r9], edx
mov eax, 0xfffffff0
pop r15
pop r14
pop rdi
ret
mov qword [rsp + 0x20], rbx
mov eax, 0x55555556
imul edi
xor ebx, ebx
mov qword [rsp + 0x28], rbp
mov eax, edx
mov qword [rsp + 0x38], r12
shr eax, 0x1f
lea r12, [0x1800d8d60]
add edx, eax
mov ebp, ebx
mov rcx, r15
lea edx, [rdx + rdx*2]
test edx, edx
jle 0x180013a4d
dec edx
mov qword [rsp + 0x30], rsi
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov esi, edx
lea ebp, [rdx + rdx*2]
nop word [rax + rax]
movzx r8d, byte [r11]
movzx r9d, byte [r11 + 1]
mov eax, r8d
movzx r10d, byte [r11 + 2]
mov edx, r9d
sar rax, 2
add r11, 3
and eax, 0x3f
sar edx, 4
shl r8d, 4
add edx, r8d
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
mov eax, r10d
sar eax, 6
lea edx, [rax + r9*4]
and edx, 0x3f
movzx eax, byte [rdx + r12]
mov byte [rcx + 2], al
mov eax, r10d
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx + 3], al
add rcx, 4
sub rsi, 1
jne 0x1800139e0
mov rsi, qword [rsp + 0x30]
cmp ebp, edi
jge 0x180013aad
movzx r8d, byte [r11]
inc ebp
cmp ebp, edi
jge 0x180013a60
movzx ebx, byte [r11 + 1]
mov eax, r8d
mov edx, ebx
sar rax, 2
sar edx, 4
and eax, 0x3f
shl r8d, 4
add edx, r8d
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
cmp ebp, edi
jge 0x180013a9f
and ebx, 0xf
shl ebx, 2
movsxd rax, ebx
movzx eax, byte [rax + r12]
mov byte [rcx + 2], al
jmp 0x180013aa3
mov byte [rcx + 2], 0x3d
add rcx, 3
mov byte [rcx], 0x3d
inc rcx
mov r12, qword [rsp + 0x38]
mov eax, ecx
mov rbp, qword [rsp + 0x28]
sub eax, r15d
mov rbx, qword [rsp + 0x20]
mov dword [r14], eax
xor eax, eax
mov byte [rcx], 0
pop r15
pop r14
pop rdi
ret
Function at 0x180013ad0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r10d, 2
mov dword [rcx + 0x200], 1
mov r11d, r10d
mov dword [rcx + 0x204], 1
mov esi, r8d
mov word [rcx + 0x208], 0
mov rbp, rdx
lea r9, [0x1800d8da0]
xor dil, dil
mov rax, rcx
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [r9]
lea r9, [r9 + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [r9 - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [r9 - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [r9 - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [r9 - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [r9 - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [r9 - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [r9 - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r11, 1
jne 0x180013b20
mov rbx, rcx
nop
movzx r9d, byte [rbx]
lea rbx, [rbx + 1]
xor edx, edx
mov eax, r11d
div esi
inc r11d
movzx eax, byte [rdx + rbp]
add al, r9b
add dil, al
movzx edx, dil
movzx eax, byte [rdx + rcx]
mov byte [rbx - 1], al
mov byte [rdx + rcx], r9b
cmp r11d, 0x100
jb 0x180013b80
lea rax, [rcx + 0x100]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r10, 1
jne 0x180013bc0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x180013c30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, dword [rcx + 0x204]
mov rdi, rdx
movzx r11d, byte [rcx + 0x209]
sub rdi, r10
sub r8, r10
mov rbx, rcx
lea esi, [r10 + r9]
cmp r10d, esi
jae 0x180013ce4
lea r9, [r10 + r8]
sub rdi, r8
nop
movzx edx, r10b
lea r9, [r9 + 1]
inc r10d
movzx r8d, byte [rdx + rbx + 0x100]
add r11b, r8b
movzx ecx, r11b
movzx eax, byte [rcx + rbx + 0x100]
mov byte [rdx + rbx + 0x100], al
mov byte [rcx + rbx + 0x100], r8b
movzx eax, byte [rdx + rbx + 0x100]
add al, r8b
movzx ecx, al
movzx eax, byte [rcx + rbx + 0x100]
xor al, byte [rdi + r9 - 1]
mov byte [r9 - 1], al
cmp r10d, esi
jb 0x180013c70
mov dword [rbx + 0x204], r10d
mov byte [rbx + 0x209], r11b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [rcx + 0x204], r10d
mov byte [rcx + 0x209], r11b
ret
Function at 0x180014030
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov esi, reloc.WS2_32.dll_recv
lea rbx, [rsp]
mov eax, esi
mov r11, rdx
mov rdi, rcx
mov r10d, 2
nop dword [rax]
nop word [rax + rax]
mov ecx, r10d
lea r8d, [r10 - 2]
movzx r8d, byte [r8 + r11]
lea edx, [r10 - 1]
movzx edx, byte [rdx + r11]
lea rbx, [rbx + 4]
shl r8d, 8
or r8d, edx
movzx edx, byte [rcx + r11]
shl r8d, 8
lea ecx, [r10 + 1]
movzx ecx, byte [rcx + r11]
or r8d, edx
shl r8d, 8
add r10d, 4
or r8d, ecx
mov dword [rbx - 4], r8d
sub rsi, 1
jne 0x180014070
lea r11, [rsp + 0x40]
nop
lea ecx, [rax - 0xf]
mov r9d, dword [rsp + rcx*4]
lea r11, [r11 + 4]
lea ecx, [rax - 2]
mov edx, r9d
mov r8d, dword [rsp + rcx*4]
mov r10d, r8d
rol r10d, 0xf
mov ecx, r8d
rol ecx, 0xd
xor r10d, ecx
rol edx, 0xe
mov ecx, r9d
shr r8d, 0xa
ror ecx, 7
xor r10d, r8d
xor edx, ecx
shr r9d, 3
lea ecx, [rax - 0x10]
xor edx, r9d
add r10d, edx
add r10d, dword [rsp + rcx*4]
lea ecx, [rax - 7]
add r10d, dword [rsp + rcx*4]
inc eax
mov dword [r11 - 4], r10d
cmp eax, 0x40
jb 0x1800140c0
mov r9d, dword [rdi + 0x50]
xor r11d, r11d
mov ebx, dword [rdi + 0x54]
mov esi, dword [rdi + 0x58]
mov r12d, dword [rdi + 0x5c]
mov r10d, dword [rdi + 0x60]
lea r15d, [r11 + 0x40]
mov ebp, dword [rdi + 0x64]
mov r14d, dword [rdi + 0x68]
mov r13d, dword [rdi + 0x6c]
lea rdi, [0x1800d8ea0]
nop word [rax + rax]
mov r8d, r10d
lea r11, [r11 + 4]
ror r8d, 0xb
mov eax, r10d
rol eax, 7
mov ecx, r10d
xor r8d, eax
not ecx
and ecx, r14d
mov eax, r10d
ror eax, 6
mov edx, r9d
xor r8d, eax
ror edx, 0xd
mov eax, ebp
and eax, r10d
xor ecx, eax
mov eax, r9d
add r8d, ecx
rol eax, 0xa
add r8d, dword [r11 + rdi - 4]
xor edx, eax
add r8d, dword [rsp + r11 - 4]
mov eax, r9d
ror eax, 2
add r8d, r13d
xor edx, eax
mov ecx, ebx
xor ecx, r9d
mov eax, ebx
and eax, r9d
and ecx, esi
xor ecx, eax
mov r13d, r14d
add edx, ecx
mov r14d, ebp
mov ebp, r10d
lea r10d, [r8 + r12]
mov r12d, esi
mov esi, ebx
mov ebx, r9d
lea r9d, [rdx + r8]
sub r15, 1
jne 0x180014150
mov rdi, qword [rsp + 0x140]
add dword [rdi + 0x54], ebx
add dword [rdi + 0x50], r9d
add dword [rdi + 0x58], esi
add dword [rdi + 0x5c], r12d
add dword [rdi + 0x60], r10d
add dword [rdi + 0x64], ebp
add dword [rdi + 0x68], r14d
add dword [rdi + 0x6c], r13d
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180014220
Capabilities:
Get user security identifier

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rsi, rdx
mov rbp, rcx
mov ecx, 0x100
call fcn.18006c7cc
mov rbx, rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x90], Ordinal_133
mov dword [rsp + 0x98], 0x44
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x98]
mov r8, rsi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test eax, eax
jne 0x18001432b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18001432b
cmp dword [rsp + 0x98], 0x44
ja 0x180014331
mov eax, dword [rsp + 0x90]
cmp eax, 0x80
jbe 0x1800142f7
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18006c7cc
mov rcx, rbx
mov rbx, rax
test rcx, rcx
je 0x1800142f7
call fcn.18006c7c4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x98]
mov r8, rsi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test edi, edi
setne dil
test rbx, rbx
je 0x18001433e
mov rcx, rbx
call fcn.18006c7c4
movzx eax, dil
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800160f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x940
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
or edi, 0xffffffff
call fcn.180071390
mov r9, rbx
lea r8, str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
mov edx, 0x100
lea rcx, [rsp + 0x40]
call fcn.1800018b0
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18001624b
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x800
call fcn.180071390
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x960]
mov qword [rsp + 0x28], rax
lea rdx, str.PnpInstanceID
lea rax, [rsp + 0x140]
mov dword [rsp + 0x960], 0x800
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180016240
lea r9d, [rdi + 4]
xor ecx, ecx
lea r8, [0x1800d9ae0]
lea rdx, [rsp + 0x140]
call qword [sym.imp.SHLWAPI.dll_StrIsIntlEqualW]
test eax, eax
je 0x180016240
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x968]
mov qword [rsp + 0x28], rax
lea rdx, str.MediaSubType
lea rax, [rsp + 0x958]
mov dword [rsp + 0x958], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x968], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x18001623e
test eax, eax
jne 0x180016240
mov eax, dword [rsp + 0x958]
cmp eax, 1
je 0x18001623e
cmp eax, 2
jne 0x180016240
lea edi, [rbx + 1]
jmp 0x180016240
mov edi, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x950]
add rsp, 0x940
pop rdi
ret
Function at 0x180016510
Capabilities:
Get mac address on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r14, rcx
xor edi, edi
mov dword [rsp + 0x40], edi
xor bpl, bpl
mov byte [rax + 0x10], bpl
xor ebx, ebx
mov dword [rax + 0x11], ebx
mov byte [rax + 0x15], bl
mov dword [rax + 8], edi
lea rdx, [rax + 8]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov r15d, dword [rsp + 0x280]
mov ecx, r15d
call fcn.18006c7cc
mov rsi, rax
test rax, rax
je 0x180016582
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.180071390
mov byte [rsi], bl
jmp 0x180016585
mov rsi, rdi
mov qword [rsp + 0x290], rsi
test rsi, rsi
je 0x1800165f6
lea rdx, [rsp + 0x280]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1800165f6
mov rbx, rsi
nop word [rax + rax]
lea rcx, [rbx + 0xc]
call fcn.1800160f0
cmp eax, 1
ja 0x1800165de
mov ecx, dword [rbx + 0x198]
mov dword [rsp + 0x288], ecx
movzx ecx, word [rbx + 0x19c]
mov word [rsp + 0x28c], cx
test eax, eax
je 0x1800165e6
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800165b0
movzx ebx, byte [rsp + 0x28d]
movzx ebp, byte [rsp + 0x288]
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x50]
call fcn.180071390
movzx eax, bl
movzx ecx, byte [rsp + 0x28c]
movzx edx, byte [rsp + 0x28b]
movzx r10d, byte [rsp + 0x28a]
movzx r9d, byte [rsp + 0x289]
movzx r8d, bpl
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._02X__02X__02X__02X__02X__02X
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rdi
cmp qword [r14 + 0x18], 8
jb 0x18001666c
mov rax, qword [r14]
jmp 0x18001666f
mov rax, r14
mov word [rax], di
cmp word [rsp + 0x50], 0
je 0x18001668d
lea rax, [rsp + 0x50]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180016683
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.1800076e0
nop
test rsi, rsi
je 0x1800166ab
mov rcx, rsi
call fcn.18006c7c4
mov rax, r14
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret