joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017960
Capabilities:
Get memory capacity

Disassembly:
push rdi
sub rsp, 0x1b0
mov rax, qword [0x18036e540]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rcx
test rcx, rcx
je 0x180017986
mov byte [rcx], 0
mov rax, qword [0x18036dbf8]
cmp rax, 0xffffffffffffffff
jne 0x180017b10
mov qword [rsp + 0x1c8], rbx
xor ebx, ebx
mov qword [rsp + 0x1d0], rbp
mov rbp, rax
mov qword [rsp + 0x1d8], rsi
mov qword [rsp + 0x1a8], r14
mov r14d, ebx
mov qword [rsp + 0x1a0], r15
mov r15d, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x180017a93
cmp dword [rsp + 0x30], ebx
je 0x180017a93
mov r9d, 0x90
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x100]
xor ecx, ecx
lea edx, [rbp + 0xa]
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x180017a93
mov eax, dword [rsp + 0x110]
mov rdx, rbp
bt eax, 9
mov rcx, rbp
mov rsi, rbp
cmovb rdx, qword [rsp + 0x178]
bt eax, 8
cmovb rcx, qword [rsp + 0x170]
test al, 1
cmovne rsi, qword [rsp + 0x120]
cmp rdx, rbp
jne 0x180017a5c
cmp rcx, rbp
jne 0x180017a5c
cmp rsi, rbp
je 0x180017a93
cmp rdx, rcx
mov dword [rsp + 0x40], 0x40
cmovb rcx, rdx
cmp rcx, rsi
cmovb rsi, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x68]
cmp rsi, rbp
mov r14, qword [rsp + 0x50]
cmovb rbp, rsi
cmp rbp, 0xffffffffffffffff
mov rsi, rbx
cmovne rsi, rbp
mov rbp, qword [rsp + 0x1d0]
test r15, r15
jne 0x180017ad4
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r15, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x88]
test rsi, rsi
cmovne r14, rsi
cmp r15, r14
mov r15, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x1a8]
cmovae rbx, rsi
mov rsi, qword [rsp + 0x1d8]
mov qword [0x18036dbf8], rbx
mov rax, qword [0x18036dbf8]
mov rbx, qword [rsp + 0x1c8]
mov rcx, rax
test rax, rax
je 0x180017b22
test rdi, rdi
je 0x180017b54
mov byte [rdi], 1
jmp 0x180017b54
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0xc0], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0xc8]
cmp qword [rsp + 0xe8], rax
cmovb rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1800631a0
add rsp, 0x1b0
pop rdi
ret

Function at 0x180017b90
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18036e540]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800631a0
add rsp, 0x78
ret
Function at 0x180017e20
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov dword [0x180377950], eax
mov eax, dword [rsp + 0x24]
mov dword [0x180377954], eax
mov eax, dword [rsp + 0x48]
mov dword [0x180377958], eax
mov dword [rsp + 0x60], ebx
mov byte [0x18037795d], bl
call fcn.180018fb0
test al, al
je 0x180017e8e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
test eax, eax
je 0x180017e8e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x180017e8e
inc eax
mov byte [0x18037795d], 1
mov dword [0x1803779e0], eax
mov byte [0x18037795e], bl
mov word [rsp + 0x60], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
mov edi, 1
test eax, eax
jne 0x180017ecb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180017ecb
movzx eax, word [rsp + 0x60]
jmp 0x180017ed2
mov eax, edi
mov word [rsp + 0x60], ax
cmp ax, di
seta cl
call fcn.180018eb0
test al, al
je 0x180017efb
call fcn.180017c00
test al, al
je 0x180017efb
cmp dword [0x1803779e4], edi
seta al
mov byte [0x18037795e], al
jmp 0x180017f02
movzx eax, byte [0x18037795e]
test al, al
je 0x180017f50
mov r9d, dword [0x1803779e8]
test r9, r9
je 0x180017fd3
lea r8, [0x180377960]
nop dword [rax]
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
inc rbx
mov rax, qword [rdx]
bts rax, rcx
mov qword [rdx], rax
cmp rbx, r9
jb 0x180017f20
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x180017fd3
mov r9, qword [rsp + 0x60]
lea r8, [0x180377960]
nop dword [rax]
test r9, rdi
je 0x180017fa1
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rcx
mov qword [rdx], rax
rol rdi, 1
test r9, rdi
je 0x180017fc6
lea rdx, [rbx + 1]
mov rax, rdx
and edx, 0x3f
shr rax, 6
lea rcx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rdx
mov qword [rcx], rax
rol rdi, 1
add rbx, 2
cmp rbx, 0x40
jb 0x180017f80
mov rbx, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x18005f060
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.18005cd00
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.18005d430
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.18005db60
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.18005db60

Function at 0x18005f180
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.18005d430
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.18005cd00
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.18005dd60
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.18005dd60
Function at 0x180060860
Capabilities:
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r13
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r14
call fcn.18005f060
mov r15, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r15
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call fcn.18005d430
vmovdqu32 zmm3, zmmword [rbx]
mov rax, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
vpmaxsd zmm1, zmm3, zmmword [rax]
mov rcx, qword [rsp + 0x80]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [rax]
vmovdqu32 zmmword [rax], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r13]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r13]
vmovdqu32 zmmword [r13], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r12]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r12]
vmovdqu32 zmmword [r12], zmm0
vmovdqu32 zmm4, zmmword [r15]
vpmaxsd zmm0, zmm4, zmmword [r14]
vmovdqu32 zmmword [r15], zmm0
vpminsd zmm1, zmm4, zmmword [r14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
vmovdqu32 zmmword [r14], zmm1
mov qword [rsp + 0x20], r14
vzeroupper
call fcn.18005f2a0
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.18005db60
Function at 0x180062760
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x50], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x58], rax
call fcn.18005f060
mov rax, qword [rsp + 0xf8]
mov r13, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r14
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov r15, qword [rsp + 0xe0]
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.18005f180
vmovdqu32 zmm3, zmmword [rbx]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xa0]
vpmaxsd zmm1, zmm3, zmmword [r9]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r9]
vmovdqu32 zmmword [r9], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r8]
mov r10, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r11, qword [rsp + 0x90]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r8]
vmovdqu32 zmmword [r8], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rdx], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
vmovdqu32 zmm3, zmmword [r15]
vpmaxsd zmm1, zmm3, zmmword [r10]
vmovdqu32 zmmword [r15], zmm1
vpminsd zmm0, zmm3, zmmword [r10]
vmovdqu32 zmmword [r10], zmm0
vmovdqu32 zmm4, zmmword [r12]
vpmaxsd zmm0, zmm4, zmmword [r11]
vmovdqu32 zmmword [r12], zmm0
vpminsd zmm1, zmm4, zmmword [r11]
vmovdqu32 zmmword [r11], zmm1
vmovdqu32 zmm3, zmmword [r13]
vpmaxsd zmm1, zmm3, zmmword [rcx]
vmovdqu32 zmmword [r13], zmm1
vpminsd zmm0, zmm3, zmmword [rcx]
vmovdqu32 zmmword [rcx], zmm0
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x38], r9
mov r9, r10
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
vmovdqu32 zmm4, zmmword [rcx]
vpmaxsd zmm0, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rcx], zmm0
vpminsd zmm1, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rbx], zmm1
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x88]
mov r8, r11
vzeroupper
call fcn.18005f2a0
mov rax, qword [rsp + 0xf8]
mov r9, r14
mov rcx, qword [rsp + 0xc0]
mov r8, rsi
mov qword [rsp + 0xb8], rax
mov rdx, rdi
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r15
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.18005f2a0
Function at 0x1800673b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800673d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800673d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x18006c190
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov edi, r8d
mov rbx, r9
mov r15, qword [rbp + 0x30]
mov r14, qword [rbp + 0x50]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1801389c0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test r15, r15
jne 0x18006c1eb
xor eax, eax
jmp 0x18006c1ef
lea rax, [r15 + 0x10]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], r14
mov r8d, edi
mov r9, rbx
mov edi, dword [rbp + 0x38]
mov rbx, qword [rbp + 0x40]
mov r15d, dword [rbp + 0x48]
mov r12d, dword [rbp + 0x58]
mov dword [rsp + 0x48], r12d
mov rcx, rdx
mov qword [rbp - 0x5c], rcx
mov rdx, rsi
mov qword [rbp - 0x64], rdx
mov dword [rbp - 0x54], r8d
mov qword [rbp - 0x6c], r9
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x40], r14
lea rcx, [rbp - 0x98]
call fcn.180004910
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.bcrypt.dll_BCryptEncrypt
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.180004960
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x18006c28c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.180138a50
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x18006c330
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov edi, r8d
mov rbx, r9
mov r15, qword [rbp + 0x30]
mov r14, qword [rbp + 0x50]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1801389c0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test r15, r15
jne 0x18006c38b
xor eax, eax
jmp 0x18006c38f
lea rax, [r15 + 0x10]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], r14
mov r8d, edi
mov r9, rbx
mov edi, dword [rbp + 0x38]
mov rbx, qword [rbp + 0x40]
mov r15d, dword [rbp + 0x48]
mov r12d, dword [rbp + 0x58]
mov dword [rsp + 0x48], r12d
mov rcx, rdx
mov qword [rbp - 0x5c], rcx
mov rdx, rsi
mov qword [rbp - 0x64], rdx
mov dword [rbp - 0x54], r8d
mov qword [rbp - 0x6c], r9
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x40], r14
lea rcx, [rbp - 0x98]
call fcn.180004910
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.bcrypt.dll_BCryptDecrypt
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.180004960
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x18006c42c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.180138a50
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x18006c770
Capabilities:
Hash data via bcrypt

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov edi, r8d
mov ebx, r9d
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1801389c0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
mov r8, qword [rsi]
mov qword [rbp - 0x48], r8
mov rcx, rdx
mov qword [rbp - 0x58], rcx
mov rdx, r8
mov qword [rbp - 0x60], rdx
mov r8d, edi
mov dword [rbp - 0x4c], r8d
mov r9d, ebx
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.180004910
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8d, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.bcrypt.dll_BCryptHashData
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.180004960
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x18006c81d
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.180138a50
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x18006ed60
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.180004910
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.180004960
mov ecx, esi
test ecx, ecx
jne 0x18006edd6
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
or ecx, 0x1000000
call fcn.18006dc80
mov rcx, rax
call fcn.180004a70
int3

Function at 0x180072dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rdi, r8
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1801389c0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rsi, rsi
je 0x180072e21
add rsi, 0xc
jmp 0x180072e23
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r14, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rdx, rsi
mov qword [rbp - 0x58], rdx
mov r8, rdi
mov qword [rbp - 0x60], r8
mov r9, rbx
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.180004910
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.180004960
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x180072e9c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.180138a50
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180074620
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rdi, rdx
mov ebx, r8d
mov rsi, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1801389c0
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
test rdi, rdi
jne 0x180074674
xor r15d, r15d
jmp 0x180074678
lea r15, [rdi + 0x10]
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov edi, dword [rbp + 0x30]
mov dword [rsp + 0x20], edi
mov rcx, r14
mov qword [rbp - 0x5c], rcx
mov rdx, r15
mov qword [rbp - 0x64], rdx
mov r8d, ebx
mov dword [rbp - 0x54], r8d
mov r9, rsi
mov qword [rbp - 0x6c], r9
lea rcx, [rbp - 0x98]
call fcn.180004910
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.180004960
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
test esi, esi
setne sil
movzx esi, sil
cmp byte [rbp - 0x40], 0
je 0x180074707
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.180138a50
call fcn.18000303b
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x180074af0
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov qword [rbp + 0x10], rcx
mov esi, edx
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1801389c0
mov rcx, qword [rbp + 0x10]
mov rdi, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x4c], rcx
mov edx, esi
mov dword [rbp - 0x44], edx
lea rcx, [rbp - 0x78]
call fcn.180004910
mov rcx, qword [rbp - 0x4c]
mov edx, dword [rbp - 0x44]
call sub.KERNEL32.dll_TerminateProcess
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.180004960
call sub.KERNEL32.dll_GetLastError
mov edi, eax
test esi, esi
setne sil
movzx esi, sil
cmp byte [rbp - 0x40], 0
je 0x180074b7b
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.180138a50
call fcn.18000303b
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180074cf0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov esi, edx
test rcx, rcx
jne 0x180074d1d
xor edi, edi
jmp 0x180074d21
lea rdi, [rcx + 0x10]
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], r8
mov rbx, r8
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov edx, esi
mov dword [rbp - 0x4c], edx
mov r8, rbx
mov qword [rbp - 0x5c], r8
lea rcx, [rbp - 0x88]
call fcn.180004910
mov rcx, qword [rbp - 0x54]
mov edx, dword [rbp - 0x4c]
mov r8, qword [rbp - 0x5c]
call sub.KERNEL32.dll_K32EnumProcesses
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.180004960
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test esi, esi
setne sil
movzx esi, sil
call fcn.18000303b
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret