joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b8c40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
mov qword [rcx + 8], r15
mov dword [rcx], r15d
mov dword [rcx + 0x10], r15d
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x40], r15
mov dword [rcx + 0x58], r15d
mov dword [rcx + 0x9470], r15d
mov qword [rcx + 0x28], r15
mov dword [rcx + 0x30], r15d
mov qword [rcx + 0x38], r15
mov qword [rcx + 0x48], r15
mov qword [rcx + 0x50], r15
add rcx, 0xb4b0
call fcn.140023540
xor r9d, r9d
mov qword [rdi + 0xb520], r15
xor r8d, r8d
lea edx, [r15 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r15 + 1]
xor r8d, r8d
mov qword [rdi + 0x18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [0x1400c14e0]
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r9, rdi
mov qword [rsp + 0x28], rdi
lea r8, [0x1400bd700]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
je 0x1400b8d14
lea edx, [r15 - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp qword [rdi + 0x40], r15
je 0x1400b8d23
mov eax, dword [rdi + 0x58]
mov dword [0x140170244], eax
call fcn.14008ab10
xor r8d, r8d
xor ecx, ecx
mov rbp, rax
lea edx, [r8 + 0x30]
call fcn.140047270
mov rbx, rax
mov r14d, 3
test rax, rax
je 0x1400b8d73
lea rax, [0x14011c448]
mov qword [rbx], rax
call fcn.1400211f0
mov qword [rbx + 0x10], rax
lea rax, [0x14011ee50]
mov qword [rbx], rax
lea rax, [0x1400bee70]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x18], rdi
mov rsi, rbx
test rbx, rbx
je 0x1400b8dc7
mov dl, 1
mov rcx, rbp
call fcn.140014190
mov rax, qword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x38]
movsxd rsi, dword [rbp + 8]
lea eax, [rsi + 1]
mov dword [rbp + 8], eax
cmp eax, dword [rbp + 0xc]
jle 0x1400b8dac
mov edx, esi
mov rcx, rbp
call fcn.140019100
mov rax, rsi
mov rsi, r15
shl rax, 4
add rax, qword [rbp]
mov qword [rax], rbx
mov rbx, r15
mov dword [rax + 8], r14d
mov r14d, r15d
test r14d, r14d
mov rcx, rsi
cmove rcx, r15
test rcx, rcx
je 0x1400b8de7
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
test rsi, rsi
je 0x1400b8e0b
mov rcx, rsi
jmp 0x1400b8dfe
test r14d, r14d
je 0x1400b8e0b
test rbx, rbx
je 0x1400b8e18
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
mov rcx, rbx
xor r8d, r8d
xor edx, edx
call fcn.140047270
mov rbx, rax
test rbx, rbx
je 0x1400b8e18
mov rcx, rbx
call fcn.1400443e0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400bc050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push r12
push r13
sub rsp, 0x28
mov qword [rsp + 0x58], rdi
mov r12, rdx
mov qword [rsp + 0x60], r14
mov rsi, rcx
mov qword [rsp + 0x20], r15
call fcn.14002ad40
mov r14, rax
call fcn.14002fb30
mov r8, qword [rsi]
xor r13d, r13d
mov rdi, 0xffffffffffffffff
mov r15, rax
mov rdx, rdi
mov r9, qword [r8]
mov word [r9], r13w
mov r8, qword [rsi]
mov rcx, qword [r8]
nop dword [rax]
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400bc0a0
mov r8d, dword [rsi + 8]
movsxd rax, edx
mov qword [rsp + 0x50], rbx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400bc0e6
movsxd rbx, eax
mov rdx, r14
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov r14, qword [rsp + 0x60]
mov rdx, rdi
nop
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400bc0f0
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400bc131
movsxd rbx, eax
lea rdx, str.Binaries_
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov rdx, rdi
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400bc134
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400bc171
movsxd rbx, eax
mov rdx, r15
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov r15, qword [rsp + 0x20]
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400bc180
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400bc1c1
movsxd rbx, eax
lea rdx, [0x140129090]
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x1400bc1c1
movsxd rax, edi
sub r8d, edi
mov rdi, qword [rsp + 0x58]
lea rbp, [rcx + rax*2]
test r8d, r8d
jle 0x1400bc1fe
movsxd rbx, r8d
mov rdx, r12
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, qword [rsp + 0x50]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1400c15a0
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
mov qword [rsp + 0x30], 0
cmp r14, rax
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
setne sil
mov rcx, rbx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c160f
xor al, al
jmp 0x1400c16ba
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x64], rax
mov eax, dword [rdi + 0x54]
add eax, eax
mov dword [rsp + 0x60], ebp
cmp dword [rdi + 0x50], 0
mov dword [rsp + 0x6c], esi
mov dword [rsp + 0x50], 0x10000
mov dword [rsp + 0x54], eax
je 0x1400c1641
mov rax, qword [rdi + 0x48]
jmp 0x1400c1648
lea rax, [0x14011c560]
mov qword [rsp + 0x58], rax
mov rcx, rdi
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x44], rax
call fcn.140031680
xor ebx, ebx
mov ecx, 0x1826
test al, al
cmovne ebx, ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov qword [rsp + 0x30], 0
mov r9d, ebx
mov edx, eax
mov r8, r15
lea rax, [rsp + 0x40]
mov rcx, r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call sub.dbghelp.dll_MiniDumpWriteDump
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400c17e0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x1401382c8]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov r10, rdx
xor eax, eax
mov dword [rcx + 0x40], r8d
mov qword [rcx + 0x30], rax
mov rbx, rcx
mov qword [rcx + 0x38], rax
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x48], eax
lea rax, [rdx - 1]
mov dword [rcx + 0x44], r9d
cmp rax, 0xfffffffffffffffd
ja 0x1400c1834
lea rdx, [rsp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x38], rax
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
add rsp, 0x20
pop rbx
ret
Function at 0x1400c1fb0
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov ecx, dword [0x140238534]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140211948], eax
jg 0x1400c219b
mov ecx, dword [0x140211940]
test ecx, ecx
je 0x1400c1ff5
lea eax, [rcx - 1]
test eax, eax
jne 0x1400c2184
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140143a10]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400c217e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], rdi
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov edx, r14d
mov dword [rbp - 0x28], edx
mov ecx, r14d
mov dword [rbp - 0x24], ecx
test rdi, rdi
je 0x1400c2099
cmp word [rdi], cx
je 0x1400c2099
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], cx
jne 0x1400c2054
inc ebx
test ebx, ebx
jle 0x1400c2074
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1400195a0
mov ecx, dword [rbp - 0x24]
mov edx, dword [rbp - 0x28]
lea eax, [rbx + rdx]
mov dword [rbp - 0x28], eax
cmp eax, ecx
jle 0x1400c2087
lea rcx, [rbp - 0x30]
call fcn.140019200
mov rcx, qword [rbp - 0x30]
mov rdx, rdi
movsxd r8, ebx
add r8, r8
call fcn.140032f60
lea r9, [0x140129090]
mov dword [rsp + 0x20], 1
lea r8, [0x14011ecb0]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.14001f940
mov rcx, qword [rax]
mov r8d, dword [rax + 8]
mov qword [rax], r14
mov qword [rbp - 0x40], rcx
mov ecx, dword [rax + 0xc]
mov qword [rax + 8], r14
mov eax, r8d
neg eax
mov dword [rbp - 0x38], r8d
mov dword [rbp - 0x34], ecx
sbb edx, edx
add edx, 7
add edx, r8d
cmp edx, ecx
jle 0x1400c20f2
lea rcx, [rbp - 0x40]
call fcn.1400195a0
mov r8d, 6
lea rdx, str._Epic_
lea rcx, [rbp - 0x40]
call fcn.14001cc30
mov rcx, qword [0x140211938]
mov rsi, qword [rbp - 0x40]
mov ebx, dword [rbp - 0x38]
mov edi, dword [rbp - 0x34]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x1400c2130
call fcn.1400443e0
mov rcx, qword [rbp - 0x20]
mov qword [0x140211938], rsi
mov rsi, qword [rsp + 0x90]
mov dword [0x140211940], ebx
mov rbx, qword [rsp + 0x88]
mov dword [0x140211944], edi
mov rdi, qword [rsp + 0x68]
test rcx, rcx
je 0x1400c2166
call fcn.1400443e0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400c2174
call fcn.1400443e0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [0x140211940]
test ecx, ecx
lea rax, [0x14011c560]
cmovne rax, qword [0x140211938]
add rsp, 0x70
pop rbp
ret
lea rcx, [0x140211948]
call fcn.14010fb6c
cmp dword [0x140211948], 0xffffffff
jne 0x1400c1fe0
lea rcx, [0x140117c30]
call fcn.14010f8d0
lea rcx, [0x140211948]
call fcn.14010fb0c
jmp 0x1400c1fe0
Function at 0x1400c2880
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x538
mov rax, qword [0x1401674b8]
xor rax, rsp
mov qword [rsp + 0x520], rax
call fcn.1400c7a40
cmp qword [rsp + 0x548], 0
je 0x1400c28c2
cmp dword [rsp + 0x550], 0
jne 0x1400c28c9
xor eax, eax
jmp 0x1400c296d
mov r8d, dword [rsp + 0x540]
xor edx, edx
mov ecx, 0x1b
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400c28ef
xor eax, eax
jmp 0x1400c296d
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rcx, [rsp + 0x30]
call fcn.1400c1850
mov dword [rsp + 0x70], 0x100001
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x510], rax
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400c2953
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x550]
mov rcx, qword [rsp + 0x548]
call fcn.1400c2670
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.14010f980
add rsp, 0x538
ret

Function at 0x1400c2c00
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x40
xor r9d, r9d
mov dword [rsp + 0x20], 0x18
lea r8, [rsp + 0x20]
mov qword [rsp + 0x28], 0
mov rbx, rcx
mov dword [rsp + 0x30], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400c2c50
mov rcx, qword [rbx]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1400c2c50
mov al, 1
add rsp, 0x40
pop rbx
ret
xor al, al
add rsp, 0x40
pop rbx
ret
Function at 0x1400c33c0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
xorps xmm0, xmm0
mov rbx, r8
movups xmmword [rax - 0x78], xmm0
mov dword [rax - 0x78], 0x70
movups xmmword [rax - 0x68], xmm0
mov qword [rax - 0x60], rcx
lea rcx, [rsp + 0x20]
mov dword [rax - 0x74], 0x4040
movups xmmword [rax - 0x58], xmm0
movups xmmword [rax - 0x48], xmm0
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
lea rax, str.runas
mov dword [rsp + 0x50], 5
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400c3469
mov rcx, qword [rsp + 0x88]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rbx, rbx
je 0x1400c3450
mov rcx, qword [rsp + 0x88]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x90
pop rbx
ret
xor al, al
add rsp, 0x90
pop rbx
ret

Function at 0x1400c3ce0
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [0x1401674b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp qword [0x140166070], 0
jne 0x1400c3e2c
xorps xmm0, xmm0
mov qword [r11 + 8], rbx
movups xmmword [rsp + 0x50], xmm0
mov qword [r11 + 0x10], rsi
lea rcx, [r11 - 0x58]
mov qword [r11 - 8], rdi
mov edi, 0x40
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x28], xmm0
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rsp + 0x58]
mov r9d, 0x3f
mov ecx, dword [rsp + 0x48]
mov rax, qword [rsp + 0x78]
mov qword [0x140166078], rax
mov eax, dword [rsp + 0x24]
mov qword [0x140166098], rax
mov qword [0x140166080], rax
lea rax, [rbx - 1]
mov qword [0x140166090], rcx
mov qword [0x140166088], rcx
bsr r10, rbx
mov qword [0x140166070], rbx
setne r11b
bsr rcx, rax
mov eax, r9d
setne r8b
sub eax, ecx
mov ecx, eax
xor esi, esi
test r8b, r8b
mov eax, edi
mov edx, esi
cmovne eax, esi
cmovne edx, ecx
or dl, al
sub r9d, r10d
sub dil, dl
mov eax, r9d
test r11b, r11b
mov ecx, esi
mov edx, 1
cmovne ecx, eax
mov eax, 0xffffffff
cmovne eax, esi
mov rsi, qword [rsp + 0xb8]
or rcx, rax
lea rax, [rbx + 0x3fffffff]
mov rbx, qword [rsp + 0xb0]
shl rcx, 0x39
sar rcx, 0x3f
not cl
and cl, dil
mov rdi, qword [rsp + 0xa0]
shl rdx, cl
shr rax, 0x1e
mov dword [0x1401660a8], eax
mov qword [0x1401660a0], rdx
lea rax, [0x140166070]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14010f980
add rsp, 0xa8
ret
Function at 0x1400c3e60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov eax, 0x80
mov qword [rcx], rsi
mov edi, esi
mov qword [rcx + 8], rsi
cmp eax, esi
mov rbx, rcx
jle 0x1400c3e9a
mov dword [rbx + 8], eax
cmp eax, dword [rbx + 0xc]
jle 0x1400c3ea9
mov edx, edi
mov rcx, rbx
call fcn.140019200
jmp 0x1400c3ea9
jge 0x1400c3ea9
je 0x1400c3ea9
mov rcx, rbx
mov dword [rbx + 8], eax
call fcn.1400193a0
mov rdx, qword [rbx]
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400c3f2c
movsxd rdi, dword [rbx + 8]
cmp eax, edi
jae 0x1400c3e84
inc eax
cmp eax, edi
jle 0x1400c3f04
mov esi, eax
mov dword [rbx + 8], eax
sub esi, edi
cmp eax, dword [rbx + 0xc]
jle 0x1400c3edd
mov edx, edi
mov rcx, rbx
call fcn.140019200
mov rax, qword [rbx]
xor edx, edx
movsxd r8, esi
add r8, r8
lea rcx, [rax + rdi*2]
call sub.VCRUNTIME140.dll_memset
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
jge 0x1400c3f4b
mov ecx, edi
sub ecx, eax
je 0x1400c3f4b
sub edi, ecx
mov rcx, rbx
mov dword [rbx + 8], edi
call fcn.1400193a0
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], esi
test eax, eax
jns 0x1400c3f40
xor edx, edx
mov rcx, rbx
call fcn.1400195a0
mov rax, qword [rbx]
test rax, rax
je 0x1400c3f4b
mov word [rax], si
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c72e0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x1401674b8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
call fcn.140023540
xorps xmm0, xmm0
mov qword [rbx + 0x70], 0
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0xa0], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x50], rdx
mov qword [rbx + 0x50], rcx
mov rcx, qword [rsp + 0x68]
cmovbe rdx, qword [rsp + 0x50]
mov qword [rbx + 0x58], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rbx], rax
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x60], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rbx + 0x40], rax
mov rax, rbx
mov qword [rbx + 0x68], rcx
mov qword [rbx + 0x48], rdx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14010f980
add rsp, 0xc0
pop rbx
ret
Function at 0x1400c7fd0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1401674b8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r12d, r12d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x20], r12
mov r14, r8
mov qword [rsp + 0x28], r12
mov r15, rdx
mov dil, 1
mov esi, r12d
mov r13d, r12d
test rdx, rdx
je 0x1400c809c
cmp word [rdx], r12w
je 0x1400c809c
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], r12w
jne 0x1400c8033
inc ebx
test ebx, ebx
jle 0x1400c805d
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1400195a0
mov r13d, dword [rsp + 0x2c]
mov esi, dword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
mov edx, esi
add esi, ebx
mov dword [rsp + 0x28], esi
cmp esi, r13d
jle 0x1400c8082
lea rcx, [rsp + 0x20]
call fcn.140019200
mov r13d, dword [rsp + 0x2c]
mov esi, dword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
movsxd r8, ebx
mov rdx, r15
add r8, r8
mov rcx, r12
call fcn.140032f60
mov eax, 4
test esi, esi
jne 0x1400c80a1
mov eax, 5
lea edx, [rsi + rax]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x3c], r13d
cmp edx, r13d
jle 0x1400c80c1
lea rcx, [rsp + 0x30]
call fcn.1400195a0
mov r8d, 3
lea rdx, [0x14012c878]
lea rcx, [rsp + 0x30]
call fcn.14001e580
cmp dword [rsp + 0x38], 0
lea rbx, [0x14011c560]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx r9d, dil
cmovne r8, qword [rsp + 0x30]
call fcn.1400cc4b0
cmp dword [rsp + 0x28], 0
lea rdx, [rsp + 0x50]
cmovne rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, qword [rsp + 0x20]
mov rbx, rax
test rcx, rcx
je 0x1400c812b
call fcn.1400443e0
cmp rbx, 0xffffffffffffffff
je 0x1400c8195
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rsp + 0x7c]
movzx eax, word [rsp + 0x7e]
cmp cx, 0x2e
jne 0x1400c8166
test ax, ax
je 0x1400c8175
cmp cx, cx
jne 0x1400c8166
cmp ax, cx
jne 0x1400c8166
cmp word [rbp - 0x80], 0
je 0x1400c8175
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x50]
call qword [r14]
movzx edi, al
test dil, dil
je 0x1400c818c
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400c8140
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400c81a4
call fcn.1400443e0
movzx eax, dil
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14010f980
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ca1e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rbx
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor bl, bl
mov qword [r11 + 0x20], rsi
xor r14d, r14d
mov qword [r11 - 0x38], r12
mov rax, rdx
mov r13d, r14d
mov r15, r9
mov rdi, r8
mov edx, 0x200
nop dword [rax]
test bl, bl
jne 0x1400ca3bb
mov r9d, 0x100
mov qword [rbp - 0x20], r14
test r13d, r13d
cmove r9d, edx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
or r9d, 0x20019
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ca3a1
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov dword [rbp - 0x28], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ca397
mov eax, dword [rbp - 0x28]
test eax, eax
je 0x1400ca397
mov ecx, eax
call fcn.1400134a0
mov rcx, qword [rbp - 0x20]
mov r12, rax
lea rax, [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ca38f
mov esi, dword [rbp - 0x28]
mov rbx, r14
shr esi, 1
mov edi, r14d
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 0
test r12, r12
je 0x1400ca349
cmp esi, 1
jbe 0x1400ca349
cmp word [r12], ax
je 0x1400ca349
test esi, esi
je 0x1400ca30a
mov edx, esi
lea rcx, [rbp - 0x18]
call fcn.1400195a0
mov r14d, dword [rbp - 0xc]
mov edi, dword [rbp - 0x10]
mov rbx, qword [rbp - 0x18]
mov edx, edi
add edi, esi
mov dword [rbp - 0x10], edi
cmp edi, r14d
jle 0x1400ca32a
lea rcx, [rbp - 0x18]
call fcn.140019200
mov r14d, dword [rbp - 0xc]
mov edi, dword [rbp - 0x10]
mov rbx, qword [rbp - 0x18]
lea r8, [rsi*2 - 2]
mov rdx, r12
mov rcx, rbx
call fcn.140032f60
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2 - 2], si
jmp 0x1400ca34b
xor esi, esi
lea rax, [rbp - 0x18]
cmp r15, rax
je 0x1400ca379
mov rcx, qword [r15]
test rcx, rcx
je 0x1400ca361
call fcn.1400443e0
mov qword [r15], rbx
mov dword [r15 + 0xc], r14d
xor r14d, r14d
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rsi
mov dword [r15 + 8], edi
jmp 0x1400ca389
test rbx, rbx
je 0x1400ca386
mov rcx, rbx
call fcn.1400443e0
xor r14d, r14d
mov rdi, qword [rbp + 0x48]
mov bl, 1
mov rcx, r12
call fcn.140013530
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0x40]
inc r13d
mov rcx, qword [rbp + 0x38]
mov edx, 0x200
cmp r13d, 2
jl 0x1400ca220
mov r12, qword [rsp + 0x50]
movzx eax, bl
mov rsi, qword [rsp + 0xa8]
add rsp, 0x58
pop r15
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret