joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140159770
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], pe_nt_image_headers64
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x14015981f
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x14015982e
cmp ecx, 0x17
jne 0x140159855
cmp eax, 0x1b
jbe 0x14015986e
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
jmp 0x14015985c
cmp eax, 0xf
jbe 0x14015986e
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, [0x141a5cae8]
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
ud2

Function at 0x14015a400
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x141a5cc38]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x14015a463
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14015a46e
xor edx, edx
jmp 0x14015a47e
cmp eax, 0x103
je 0x14015a4a8
test eax, eax
js 0x14015a489
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x141a5cc98]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.140157310
mov rcx, rax
call fcn.140198c30
mov ecx, 7
int 0x29
ud2
Function at 0x14015a730
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x141a5cc38]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x14015a79a
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14015a7cd
test eax, eax
js 0x14015a7ae
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x141a5cc98]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.140157310
mov rcx, rax
call fcn.140198c30
mov ecx, 7
int 0x29
ud2
Function at 0x14015aec0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x14015af3e
mov rax, qword [0x141ade038]
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x14015af75
cmp dword [rsp + 0x2c], 0
je 0x14015af66
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14015af77
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x141ada078]
nop dword [rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x141ada078], rsi
jne 0x14015af20
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14015af6b
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14015af75
mov edi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
je 0x14015af6b
mov esi, eax
mov ecx, edi
call sub.KERNEL32.dll_TlsFree
dec esi
mov edi, esi
jmp 0x14015af6b
mov edi, dword [rsi + 0x18]
dec edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2
Function at 0x14015ce50
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
test cx, cx
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor edi, edi
mov ecx, ebx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14015cf23
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x14015cead
mov esi, eax
cmp eax, 0x2726
jne 0x14015cf16
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14015cf0f
mov rsi, rax
xor edi, edi
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x14015cf23
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rcx, rsi
call sub.ws2_32.dll_closesocket
mov edi, 1
mov rsi, rbx
jmp 0x14015cf23
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov edi, 1
mov rax, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14015d730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x140216120]
test ecx, ecx
je 0x14015d81c
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14015d75f
cmp qword [rax + 8], 0
jne 0x14015d816
mov ecx, dword [0x140216120]
test ecx, ecx
je 0x14015d83e
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14015d85b
test rax, rax
jne 0x14015d7cf
movzx eax, byte [0x141ada129]
mov edx, 0x20
xor ecx, ecx
call fcn.14014fee0
test rax, rax
je 0x14015d87d
lea rcx, [0x140216108]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x140216120]
test ecx, ecx
je 0x14015d864
dec ecx
mov rdx, rax
mov rdi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rdi
test rsi, rsi
je 0x14015d7e8
mov rcx, qword [rsi]
movups xmm0, xmmword [rsi + 8]
mov qword [rsi], 0
cmp rcx, 1
je 0x14015d80a
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
mov rsi, rax
call sub.bcryptprimitives.dll_ProcessPrng
mov rax, rsi
movaps xmm0, xmmword [rsp + 0x20]
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm0
add rax, 0x10
jmp 0x14015d85d
lea rcx, [0x140216108]
call fcn.14015aec0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14015d754
jmp 0x14015d75f
lea rcx, [0x140216108]
call fcn.14015aec0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14015d77e
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x140216108]
mov rdi, rax
call fcn.14015aec0
mov ecx, eax
mov rax, rdi
jmp 0x14015d7c1
ud2

Function at 0x14015e0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
movzx r9d, byte [rdx + 0x38]
cmp r9b, 1
ja 0x14015e14a
movzx eax, byte [rdx + 0x3a]
test al, al
jne 0x14015e122
movzx esi, byte [rdx + 0x10]
lea r8d, [rsi - 5]
cmp r8b, 1
ja 0x14015e122
mov r10, qword [rdx]
mov r8, qword [rdx + 8]
xor r11d, r11d
test r9b, r9b
jne 0x14015e119
cmp sil, 6
je 0x14015e119
mov r11d, 2
cmp r8, 1
jbe 0x14015e2f7
cmp r11, r8
jne 0x14015e255
xor r8d, r8d
xor eax, eax
xor r8d, r8d
add r8, r10
lea rsi, [r10 + r11]
Function at 0x1401607f0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x141a5c5d0]
cmovne rdx, rcx
add rsp, 0x58
ret

Function at 0x140162210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x140216160]
test ecx, ecx
je 0x14016223f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140162258
cmp byte [rax + 8], 0
je 0x140162258
add rax, 9
jmp 0x140162305
lea rcx, [0x140216148]
call fcn.14015aec0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140162230
mov ecx, dword [0x140216160]
test ecx, ecx
je 0x1401622e6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140162303
test rax, rax
jne 0x1401622c0
movzx eax, byte [0x141ada129]
mov edx, 0x10
xor ecx, ecx
call fcn.14014fee0
test rax, rax
je 0x140162322
lea rcx, [0x140216148]
mov qword [rax], rcx
mov byte [rax + 8], 0
mov ecx, dword [0x140216160]
test ecx, ecx
je 0x14016230c
dec ecx
mov rdx, rax
mov rdi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rdi
xor ecx, ecx
test rsi, rsi
je 0x1401622d6
cmp byte [rsi], 0
mov byte [rsi], 0
movzx edx, byte [rsi + 1]
cmove edx, ecx
mov ecx, edx
lea rdx, [rax + 9]
mov byte [rax + 8], 1
mov byte [rax + 9], cl
mov rax, rdx
jmp 0x140162305
lea rcx, [0x140216148]
call fcn.14015aec0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140162277
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140216148]
mov rdi, rax
call fcn.14015aec0
mov ecx, eax
mov rax, rdi
jmp 0x1401622b2
ud2
Function at 0x14016f850
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
movdqa xmmword [rsp + 0xd0], xmm7
movdqa xmmword [rsp + 0xc0], xmm6
mov rsi, rdx
mov rdi, rcx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmmword [rsp + 0x80], xmm0
lea rdx, [rsp + 0x80]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x14016f8c2
mov ebx, eax
lea rcx, [rsp + 0x80]
mov edx, 0x20
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x14016f93f
movdqa xmm7, xmmword [rsp + 0x80]
movdqa xmm6, xmmword [rsp + 0x90]
movdqu xmmword [rsp + 0xb0], xmm6
movdqu xmmword [rsp + 0xa0], xmm7
mov rax, qword [0x141ada120]
test rax, rax
je 0x14016f97f
test eax, 0x4000
jne 0x14016f98f
pshufd xmm0, xmm7, 0xee
pshufd xmm1, xmm6, 0xee
movq rax, xmm7
movq rcx, xmm0
movq rdx, xmm6
movq r8, xmm1
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
jmp 0x14016f9ad
and ebx, 0x7fffffff
je 0x14016f8c2
movzx eax, byte [0x141ada129]
mov edx, 4
xor ecx, ecx
call fcn.14014fee0
test rax, rax
je 0x14016fa4b
mov dword [rax], ebx
mov rcx, qword [0x141ada118]
xor edx, edx
mov r8, rax
call fcn.1401cdfe4
jmp 0x14016fa0f
call fcn.1401628c0
test eax, 0x4000
je 0x14016f901
lea r8, [0x141a5dc58]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
call fcn.140066930
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x40], rcx
mov qword [rdi], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rdx
mov qword [rdi + 0x20], r8
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
movaps xmm6, xmmword [rsp + 0xc0]
movaps xmm7, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
jmp fcn.140064690
ud2
Function at 0x140171d90
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x140171ef3
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd r13, dword [rsp + 0x24]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
test r13, r13
je 0x140171ec9
shl r13, 3
mov esi, 8
xor ebp, ebp
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x80]
xor r15d, r15d
jmp 0x140171e41
lea rax, [r15 + r15*2]
mov rcx, qword [rsp + 0x70]
mov qword [rsi + rax*8 + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + rax*8], xmm0
mov r15, qword [rsp + 0x38]
inc r15
mov qword [rsp + 0x38], r15
add rbp, 8
cmp r13, rbp
je 0x140171ec9
mov r12, qword [rdi + rbp]
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea rax, [r12 + rax*2]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], rax
mov word [rsp + 0x90], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r14
call fcn.140173c50
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
cmp r15, qword [rsp + 0x28]
jne 0x140171e10
lea rcx, [rsp + 0x28]
call fcn.140110ad0
mov rsi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
jmp 0x140171e10
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
test rax, rax
jne 0x140171edb
call sub.KERNEL32.dll_GetLastError
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
jmp 0x140171f0a
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140172890
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1402161b0]
test ecx, ecx
je 0x1401728c0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1401728d9
cmp qword [rax + 8], 0
je 0x1401728d9
add rax, 0x10
jmp 0x140172995
lea rcx, [0x140216198]
call fcn.14015aec0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1401728b0
mov ecx, dword [0x1402161b0]
test ecx, ecx
je 0x140172976
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140172993
test rax, rax
jne 0x140172945
movzx eax, byte [0x141ada129]
mov edx, 0x18
xor ecx, ecx
call fcn.14014fee0
test rax, rax
je 0x1401729b2
lea rcx, [0x140216198]
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, dword [0x1402161b0]
test ecx, ecx
je 0x14017299c
dec ecx
mov rdx, rax
mov rdi, rax
call sub.KERNEL32.dll_TlsSetValue
mov rax, rdi
test rsi, rsi
je 0x14017295f
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x140172961
mov rcx, qword [rsi + 8]
jmp 0x140172961
xor ecx, ecx
lea rdx, [rax + 0x10]
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
mov rax, rdx
jmp 0x140172995
lea rcx, [0x140216198]
call fcn.14015aec0
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1401728f8
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140216198]
mov rdi, rax
call fcn.14015aec0
mov ecx, eax
mov rax, rdi
jmp 0x140172937
ud2
Function at 0x140174290
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x18]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
lea r14, [rdi + 0x10]
jmp 0x1401742dd
tzcnt ecx, eax
shl ecx, 5
mov rdx, rdi
sub rdx, rcx
lea ebp, [rax - 1]
and ebp, eax
mov rcx, qword [rdx - 8]
call sub.pdh.dll_PdhRemoveCounter
mov eax, ebp
sub rbx, 1
jb 0x14017430f
test ax, ax
jne 0x1401742c0
nop dword [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rdi, 0xfffffffffffffe00
add r14, 0x10
cmp eax, 0xffff
je 0x1401742f0
not eax
jmp 0x1401742c0
mov rcx, qword [rsi + 0x38]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140174326
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x14017433f
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x140174352
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140174334
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp 0x1401f3430
jmp qword [sym.imp.pdh.dll_PdhCloseQuery]
Function at 0x1401790b0
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
movaps xmmword [rsp + 0x1c0], xmm7
movaps xmmword [rsp + 0x1b0], xmm6
mov rsi, rcx
xor ecx, ecx
call fcn.14015d730
test rax, rax
je 0x14017936a
movups xmm7, xmmword [rax]
inc qword [rax]
movzx eax, byte [0x141ada129]
mov edx, 0x56410
xor ecx, ecx
call fcn.14014fee0
test rax, rax
je 0x14017936a
mov rdi, rax
add rdi, 0x56000
mov r8d, 0x410
mov rcx, rdi
mov dl, 0xff
call sub.msvcrt.dll_memset
movzx eax, byte [0x141ada129]
mov edx, 9
xor ecx, ecx
call fcn.14014fee0
test rax, rax
je 0x14017936a
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
xorps xmm6, xmm6
movups xmmword [rsp + 0xb8], xmm6
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 0x3ff
mov qword [rsp + 0x130], 0x380
mov qword [rsp + 0x138], 0
movups xmmword [rsp + 0x140], xmm7
movups xmmword [rsp + 0x150], xmm6
movups xmmword [rsp + 0x160], xmm6
mov qword [rsp + 0x90], 9
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 9
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 1
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xd0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 8
mov qword [rsp + 0x110], 0
mov byte [rsp + 0x118], 0
mov qword [rsp + 0x170], 0
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x140179274
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x14017930e
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsp + 0x160], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsp + 0x168], rax
lea rdi, [rsp + 0x90]
mov rcx, rdi
call fcn.140176df0
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140177200
mov r8d, 0x120
mov rcx, rsi
mov rdx, rdi
call sub.msvcrt.dll_memcpy
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1c0]
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x140179370
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rsi, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x1401793b5
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0xc0], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x14017944c
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsi + 0xd0], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsi + 0xd8], rax
mov rcx, rsi
call fcn.140176df0
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140177200
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rsi
ret

Function at 0x140179960
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x140179ab9
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd r13, dword [rsp + 0x24]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
test r13, r13
je 0x140179a99
shl r13, 3
mov esi, 8
xor ebp, ebp
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x80]
xor r15d, r15d
jmp 0x140179a11
lea rax, [r15 + r15*2]
mov rcx, qword [rsp + 0x70]
mov qword [rsi + rax*8 + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + rax*8], xmm0
mov r15, qword [rsp + 0x38]
inc r15
mov qword [rsp + 0x38], r15
add rbp, 8
cmp r13, rbp
je 0x140179a99
mov r12, qword [rdi + rbp]
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea rax, [r12 + rax*2]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], rax
mov word [rsp + 0x90], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r14
call fcn.140185a00
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
cmp r15, qword [rsp + 0x28]
jne 0x1401799e0
lea rcx, [rsp + 0x28]
call fcn.140110ad0
mov rsi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
jmp 0x1401799e0
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
movups xmm0, xmmword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x10], rax
jmp 0x140179ad0
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret