joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13da0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov eax, dword [rsp + 0xb0]
mov ebx, r9d
mov edi, r8d
test eax, eax
mov rbp, rdx
mov rsi, rcx
jle 0x13dd3
cmp ebx, eax
cmovg ebx, eax
mov eax, 0x1388
test ebx, ebx
lea rcx, [rsp + 0x60]
cmovle ebx, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rdx, qword [rsi + 0x18]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
mov byte [rsp + 0x30], 1
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
test rax, rax
mov rdi, rax
jne 0x13e31
mov eax, 0xc0000017
jmp 0x13ef8
mov rax, qword [rax + 0xb8]
lea rcx, [0x00013f18]
mov rdx, rdi
and qword [rax - 0x38], 0
mov qword [rax - 0x40], rbp
mov rax, qword [rdi + 0xb8]
mov qword [rax - 0x10], rcx
lea rcx, [rsp + 0x60]
mov byte [rax - 0x45], 0xe0
mov qword [rax - 8], rcx
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x13ecf
imul ebx, ebx, 0xffffd8f0
lea rcx, [rsp + 0x60]
xor r9d, r9d
movsxd rax, ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
cmp eax, 0x102
jne 0x13ecf
lea r8, [0x00018c40]
lea rdx, [0x00017970]
lea rcx, [0x00018c60]
call fcn.000170fc
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoCancelIrp]
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ebx, dword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x149e0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rdx + 0xb8]
mov rsi, rdx
mov rdi, rcx
call fcn.000142a4
test eax, eax
mov ebx, eax
jns 0x14a28
mov rcx, rsi
mov dword [rsi + 0x30], eax
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x14b1f
cmp byte [rbp + 1], 2
jne 0x14ae5
cmp dword [rbp + 0x10], 0
mov ebx, dword [rbp + 0x18]
lea r9, [rdi + 0xa2ac]
lea r8d, [rbx - 1]
lea rcx, [0x00018ee0]
jne 0x14a5b
lea rdx, [0x00018ec0]
call fcn.0001717c
jmp 0x14a80
lea rdx, [0x00018ef0]
call fcn.0001717c
cmp ebx, dword [rdi + 0xa288]
jle 0x14a80
mov rcx, qword [rdi]
mov r8d, ebx
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_PoSetPowerState]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
mov rdx, qword [rsi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.00017450
mov byte [rbx + 3], 0
cmp dword [rdi + 0x40], 0
jne 0x14abc
cmp dword [rdi + 0xa3ac], 0
lea rcx, [0x00014b3c]
je 0x14ac3
lea rcx, [0x00014c5c]
mov rax, qword [rsi + 0xb8]
mov rdx, rsi
mov byte [rax - 0x45], 0xe0
mov qword [rax - 8], rdi
mov qword [rax - 0x10], rcx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_PoCallDriver]
jmp 0x14b21
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
add byte [rsi + 0x43], 1
add qword [rsi + 0xb8], 0x48
mov rcx, qword [rdi + 0x10]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_PoCallDriver]
mov ebx, eax
lock add dword [rdi + 0x20], 0xffffffff
jne 0x14b1f
lea rcx, [rdi + 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x15c10
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15d, r9d
mov rsi, rdx
mov rbx, rcx
mov ebp, 1
lock xadd dword [0x0001b1e0], ebp
mov rdi, qword [rsp + 0x90]
add ebp, 1
lea rcx, [0x00010000]
mov al, byte [rdi + 0x18]
mov edx, dword [rdi]
and eax, 3
test dl, dl
jns 0x15c6e
mov r8, qword [rcx + rax*8 + 0xb160]
jmp 0x15c76
mov r8, qword [rcx + rax*8 + 0xb180]
mov r12d, dword [rsp + 0x98]
test r12d, r12d
jne 0x15c87
mov r12d, dword [rdi + 0x10]
mov r14d, dword [rsp + 0xb8]
cmp r9d, 0xa
lea rcx, [0x000195b0]
mov r9d, ebp
jne 0x15cc0
and dword [rsp + 0x38], 0
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], edx
lea rdx, [0x00019570]
call fcn.0001717c
jmp 0x15cd5
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edx
lea rdx, [0x000195c0]
call fcn.0001717c
mov edx, 0x10
xor ecx, ecx
mov r8d, 0x30425355
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov r13, rax
jne 0x15d0d
lock add dword [rbx + 0x20], 0xffffffff
jne 0x15d06
lea rcx, [rbx + 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov edi, 0xc0000017
jmp 0x15d66
mov rax, qword [rsp + 0xb0]
mov r8d, dword [rsp + 0x80]
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
mov r9d, r15d
mov rdx, r13
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rdi
call fcn.00015f0c
test eax, eax
mov edi, eax
jns 0x15d7d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lock add dword [rbx + 0x20], 0xffffffff
jne 0x15d66
lea rcx, [rbx + 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
and qword [rsi + 0x38], 0
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x15de4
mov r9d, dword [rsp + 0xa0]
mov dword [r13 + 8], ebp
mov rcx, qword [rsi + 0xb8]
mov byte [rcx - 0x48], 0xf
mov rax, qword [r13]
mov dword [rcx - 0x30], 0x220003
mov qword [rcx - 0x40], rax
mov rax, qword [rsi + 0xb8]
lea rcx, [0x00015e08]
mov qword [rax - 0x10], rcx
mov qword [rax - 8], r13
mov byte [rax - 0x45], 0xe0
mov eax, dword [rsp + 0xa8]
mov r8, qword [r13]
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.00016acc
mov rcx, qword [rbx + 0x18]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x171bc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x0001b100]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, qword [rsp + 0x2c0]
movzx ebp, cl
mov r15d, ecx
mov ecx, 5
mov r13, r9
cmp ebp, ecx
cmovg ebp, ecx
cmp dword [0x0001b1e4], ebp
jge 0x17211
cmp ebp, 1
jne 0x173ae
xor edi, edi
movsxd rax, ebp
lea r12, [0x0001b110]
and dword [rsp + 0x40], edi
mov r12, qword [r12 + rax*8]
cmp ebp, ecx
cmovg ebp, ecx
bt r15d, 8
mov rbx, r8
jae 0x1725d
lea rcx, [rsp + 0x50]
mov r9, r14
mov r8, r13
mov edx, 0x1ff
call qword [sym.imp.ntoskrnl.exe__vsnprintf]
mov esi, dword [rsp + 0x40]
test eax, eax
jle 0x1734c
mov edi, eax
jmp 0x1734a
test r8, r8
je 0x172b1
cmp qword [str.usb_registry_], rdi
lea rsi, str.usb_registry_
je 0x172ac
test rbx, rbx
je 0x172b1
cmp byte [rbx], 0
je 0x172ac
mov rdx, qword [rsi]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_strstr]
cmp rax, rbx
jne 0x172a2
mov rdi, qword [rsi]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
add rbx, rcx
add rsi, 8
cmp qword [rsi], 0
jne 0x17272
test rbx, rbx
jne 0x172b8
lea rbx, [0x00019be0]
test r12, r12
je 0x172fb
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x172fb
lea r9, [0x00019bd0]
lea r8, [0x00019bf0]
lea rcx, [rsp + 0x50]
mov edx, 0x1ff
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe__snprintf]
jmp 0x1731e
lea r9, [0x00019bd0]
lea r8, [0x00019c00]
lea rcx, [rsp + 0x50]
mov edx, 0x1ff
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe__snprintf]
test eax, eax
mov edi, eax
js 0x17350
mov esi, eax
mov eax, 0x1ff
mov r9, r14
sub eax, esi
mov r8, r13
movsxd rdx, eax
movsxd rax, esi
lea rcx, [rsp + rax + 0x50]
call qword [sym.imp.ntoskrnl.exe__vsnprintf]
test eax, eax
jle 0x1734c
add edi, eax
test eax, eax
jns 0x17359
jmp 0x17354
mov esi, dword [rsp + 0x40]
mov edi, 0x1ff
movsxd rax, edi
mov byte [rsp + rax + 0x50], 0
mov rax, qword [0x0001b1e8]
test rax, rax
je 0x17395
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], edi
lea rdx, [0x00019bd0]
mov qword [rsp + 0x28], rcx
mov r9, rbx
mov r8, r12
mov ecx, r15d
mov dword [rsp + 0x20], esi
call rax
test eax, eax
jne 0x173ae
cmp dword [0x0001b1e4], ebp
jl 0x173ae
lea rdx, [rsp + 0x50]
lea rcx, [0x00017970]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.000173f0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1404bb5c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1404bb60a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1404bb60a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1404bb60a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1404bb60a
cmp dword [rcx + 0x84], 0xe
jbe 0x1404bb60a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1404bb60c
xor al, al
add rsp, 0x28
ret

Function at 0x1404c0524
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1404c066c

Function at 0x1404c066c
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1404c066c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1404c06db
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1404c06db
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1404c06db
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1404c06db
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1404c06db
cmp dword [rcx + 0x84], 0xe
jbe 0x1404c06db
cmp dword [rcx + 0xf8], 0
je 0x1404c06db
mov ecx, ebx
call fcn.1404c05a4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1404c0800
nop
cmp dword [rbp + 0x20], 0
je 0x1404c0729
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1404c0638
int3

Function at 0x1404c22b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1404c22d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1404c22d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1404c78f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1404c7977
mov rsi, rbx
cmp word [rax], bp
je 0x1404c7936
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1404c7920
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1404c791c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1404c4c60
mov rdi, rax
test rax, rax
je 0x1404c7964
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1404d0ba0
mov rbp, rdi
xor ecx, ecx
call fcn.1404c41a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1404cc6a4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1404cc6ba
mov al, 1
jmp 0x1404cc71a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1404cc6cb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1404cc718
mov ecx, dword [rcx + 0x18]
nop
call fcn.1404c7de8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1404cc718
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1404cc718
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1404cc718
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1404cc71a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x401b47
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0040b008]
jne 0x4017ca
rol rcx, 0x10
test cx, 0xffff
jne 0x4017c6
repz ret
ror rcx, 0x10
jmp 0x401aa0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0040c160]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0040c258]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x401b25
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0040c160]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x401b47
mov rax, qword [rsp + 0x88]
mov qword [0x0040c258], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0040c1f8], rax
mov rax, qword [0x0040c258]
mov qword [0x0040c0d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0040c1e0], rax
mov dword [0x0040c0c0], 0xc0000409
mov dword [0x0040c0c4], 1
mov rax, qword [0x0040b008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0040b010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0040c158], eax
mov ecx, 1
call fcn.00403920
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00408280]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0040c158], 0
jne 0x401bce
mov ecx, 1
call fcn.00403920
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x404650
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00403290
xor ebx, ebx
cmp qword [0x0040cd70], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x404781
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x4046b3
xor eax, eax
jmp 0x404861
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x4046ac
mov rcx, rax
call fcn.00403220
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0040cd70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00403220
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0040cd78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00403220
lea rcx, [rsp + 0x30]
mov qword [0x0040cd80], rax
call fcn.00401cd0
test eax, eax
je 0x404737
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00403c10
cmp dword [rsp + 0x30], 2
jne 0x404781
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00403220
test rax, rax
mov qword [0x0040cd90], rax
je 0x404781
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00403220
mov qword [0x0040cd88], rax
mov rcx, qword [0x0040cd88]
cmp rcx, rsi
je 0x404813
cmp qword [0x0040cd90], rsi
je 0x404813
call fcn.004032f0
call rax
test rax, rax
mov rbp, rax
je 0x4047de
mov rcx, qword [0x0040cd90]
call fcn.004032f0
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x4047de
test byte [rsp + 0x48], 1
jne 0x404813
lea rcx, [rsp + 0x34]
call fcn.00401d20
test eax, eax
je 0x404800
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00403c10
cmp dword [rsp + 0x34], 4
jb 0x40480d
bts edi, 0x15
jmp 0x404847
bts edi, 0x12
jmp 0x404847
mov rcx, qword [0x0040cd78]
cmp rcx, rsi
je 0x404847
call fcn.004032f0
call rax
test rax, rax
mov rbx, rax
je 0x404847
mov rcx, qword [0x0040cd80]
cmp rcx, rsi
je 0x404847
call fcn.004032f0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0040cd70]
call fcn.004032f0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140f6b1f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f6b1fa
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f6b223
pop rbp
sub rbp, 0x33
sub rbp, 0xf6b1f0
sub rsp, 0x20
jmp 0x140f6b242
mov rax, 0xf6b1f0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x19ec22ae
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f6b261
jmp 0x140f6b278
out 0x27, al
and eax, 0xaeae9227
scasb al, byte [rdi]
out 0x2f, al
outsd dx, dword [rsi]
cmpsb byte [rsi], byte [rdi]
scasd eax, dword [rdi]
scasb al, byte [rdi]
scasb al, byte [rdi]
out 0xaf, al
out 0x69, al
outsb dx, byte [rsi]
cmpsb byte [rsi], byte [rdi]
scasb al, byte [rdi]
scasb al, byte [rdi]
scasb al, byte [rdi]
out 0x69, al
insb byte [rdi], dx
xchg byte [rsi + 0x59e6aeae], ch
out 0xaf, al
outsd dx, dword [rsi]
and eax, 0xaeaea22f
scasb al, byte [rdi]
out 0xaf, al
invalid
Function at 0x140001070
Capabilities:
Check for time delay via gettickcount
Get memory capacity

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400d9008]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x28]
shr rax, 2
cmp eax, 0x1000
jb 0x14000121e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1f40
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, ebx
lea rcx, [0x14001e8c0]
mov edi, eax
call fcn.140001010
mov edx, edi
lea rcx, [0x14001e8c0]
call fcn.140001010
lea ecx, [rbx + 0x1f0e]
cmp edi, ecx
jb 0x14000121e
lea ecx, [rbx + 0x1f54]
cmp edi, ecx
ja 0x14000121e
mov ecx, 2
nop dword [rax + rax]
mov eax, 0x75bcd15
cdq
idiv ecx
test edx, edx
je 0x140001130
inc ecx
mov eax, ecx
imul eax, ecx
cmp eax, 0x75bcd15
jg 0x14000121e
jmp 0x140001110
xor r9d, r9d
mov qword [rsp + 0x80], rbp
xor r8d, r8d
mov qword [rsp + 0x88], rsi
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov edx, 0x2710
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.hello_world_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor edx, edx
mov r8d, 0x100000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
lea rbx, str.90909090_9090_9090_904d_5a4152554889
mov rdi, rax
lea rbp, str.35c3c3c3_cb80_ccc2_4655_c3c3c387faa0
nop dword [rax]
mov rcx, qword [rbx]
mov rdx, rdi
call qword [sym.imp.RPCRT4.dll_UuidFromStringA]
test eax, eax
jne 0x14000120e
add rdi, 0x10
add rbx, 8
cmp rbx, rbp
jl 0x1400011b0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001240
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400011e3
xor ecx, ecx
call fcn.1400051f4
int3
Function at 0x1400051f4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005053
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005053
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005053
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005053
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005053
cmp dword [rcx + 0x84], 0xe
jbe 0x140005053
cmp dword [rcx + 0xf8], 0
je 0x140005053
mov ecx, ebx
call fcn.140005110
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140004ee0
nop
cmp dword [rbp + 0x20], 0
je 0x1400050a1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400050ac
int3
xor r8d, r8d
xor edx, edx
jmp 0x140004fe4
Function at 0x14000d1f0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000d220
xor eax, eax
jmp 0x14000d2e3
mov rbp, rbx
cmp word [rax], si
je 0x14000d245
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d22c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d228
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d140
movsxd r14, eax
test eax, eax
jne 0x14000d283
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000d219
mov rcx, r14
call fcn.1400099f0
mov rdi, rax
test rax, rax
jne 0x14000d29c
xor ecx, ecx
call fcn.140008d7c
jmp 0x14000d278
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d140
test eax, eax
jne 0x14000d2cd
mov rcx, rdi
call fcn.140008d7c
jmp 0x14000d2d7
xor ecx, ecx
call fcn.140008d7c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret